openapi: 3.0.1
info:
  title: Connector API
  version: ''
  description: >
    The Synqly Connector APIs provide a unifying interface and data model for
    all supported service Providers.


    See the [Synqly Overview](/guides/getting-started/overview) for more
    information.
paths:
  /v1/app-sec/applications:
    get:
      description: >-
        {% admonition type="info" name="Pre-Release" %}

        This operation is available for testing but may be unstable. Breaking

        changes are unlikely but may still be necessary.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of applications matching the query from a the
        token-linked application security integration.


        **Operation ID:** `appsec_query_applications`
      operationId: appsec_query_applications
      tags:
        - Appsec
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: >-
            Number of applications to return. Defaults to 100 with a maximum of
            5000. If a provider has a maximum limit lower than 5000, the
            provider's maximum limit will be used instead.
          required: false
          schema:
            type: integer
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppSecQueryApplicationsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Applications
      security:
        - BearerAuth: []
      x-badges:
        - name: Beta
          color: pre-release
          position: before
  /v1/app-sec/applications/{applicationId}/findings:
    get:
      description: >-
        {% admonition type="info" name="Pre-Release" %}

        This operation is available for testing but may be unstable. Breaking

        changes are unlikely but may still be necessary.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of an application's findings matching `{applictionId}`
        and the query from a the token-linked application security integration.


        **Operation ID:** `appsec_query_application_findings`
      operationId: appsec_query_application_findings
      tags:
        - Appsec
      parameters:
        - name: applicationId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: >-
            Number of findings to return. Defaults to 100 with a maximum of
            5000. If a provider has a maximum limit lower than 5000, the
            provider's maximum limit will be used instead.
          required: false
          schema:
            type: integer
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppSecQueryApplicationFindingsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Application Findings
      security:
        - BearerAuth: []
      x-badges:
        - name: Beta
          color: pre-release
          position: before
  /v1/app-sec/findings:
    get:
      description: >-
        {% admonition type="info" name="Pre-Release" %}

        This operation is available for testing but may be unstable. Breaking

        changes are unlikely but may still be necessary.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of each findings details combined with the application
        details for all applications in the token-linked application security
        integration. This API may perform multiple provider API calls per
        executation so can be slower to respond.


        **Operation ID:** `appsec_query_findings`
      operationId: appsec_query_findings
      tags:
        - Appsec
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: >-
            Number of findings to return. Defaults to 100 with a maximum of
            5000. If a provider has a maximum limit lower than 5000, the
            provider's maximum limit will be used instead.
          required: false
          schema:
            type: integer
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppSecQueryFindingsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query findings across all applications
      security:
        - BearerAuth: []
      x-badges:
        - name: Beta
          color: pre-release
          position: before
  /v1/app-sec/applications/{applicationId}/findings/{findingId}:
    get:
      description: >-
        {% admonition type="info" name="Pre-Release" %}

        This operation is available for testing but may be unstable. Breaking

        changes are unlikely but may still be necessary.


        Please contact us before using this operation.

        {% /admonition %}

        Returns the details of the finding matching `{findingId}` where the
        finding belongs to the application matching `{applicationId}` from the
        token-linked application security integration.


        **Operation ID:** `appsec_get_application_finding_details`
      operationId: appsec_get_application_finding_details
      tags:
        - Appsec
      parameters:
        - name: applicationId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: findingId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/AppSecGetApplicationFindingDetailsResponse
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Application Finding Details
      security:
        - BearerAuth: []
      x-badges:
        - name: Beta
          color: pre-release
          position: before
  /v1/assets/devices:
    get:
      description: |-
        Query devices from an asset inventory system

        **Operation ID:** `assets_query_devices`
      operationId: assets_query_devices
      tags:
        - Assets
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of finding reports to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to the Assets Filtering Guide. Defaults to no filter. If used
            more than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `time`. To
            control the direction of the sorting, append

            `[asc]` or `[desc]` to the field name. For example, `time[asc]` will
            sort the results by `time` in ascending order.

            The ordering defaults to `asc` if not specified.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryDevicesResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Devices
      security:
        - BearerAuth: []
    post:
      description: |-
        Creates a `Device` object in the token-linked Integration.

        **Operation ID:** `assets_create_asset`
      operationId: assets_create_asset
      tags:
        - Assets
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateDeviceResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Devices
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateDeviceRequest'
  /v1/assets/labels:
    get:
      description: |-
        Get labels from an asset inventory system

        **Operation ID:** `assets_get_labels`
      operationId: assets_get_labels
      tags:
        - Assets
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLabelsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Labels
      security:
        - BearerAuth: []
  /v1/cloudsecurity/events:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of events that match the query from the cloud security
        provider.


        **Operation ID:** `cloudsecurity_query_events`
      operationId: cloudsecurity_query_events
      tags:
        - Cloudsecurity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of events to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryEventsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Events
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/cloudsecurity/ioms:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of Indicators of Misconfiguration (IOM) findings that
        match the query from the cloud security provider.


        **Operation ID:** `cloudsecurity_query_ioms`
      operationId: cloudsecurity_query_ioms
      tags:
        - Cloudsecurity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of cloud resources to return. Defaults to 500.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the CloudSecurity in the response.
            Defaults to `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryIomsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query IOMs
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/cloudsecurity/cloudresourcesinventory:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of cloud resources that match the query from the cloud
        security provider.


        **Operation ID:** `cloudsecurity_query_cloud_resource_inventory`
      operationId: cloudsecurity_query_cloud_resource_inventory
      tags:
        - Cloudsecurity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of cloud resources to return. Defaults to 500.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the CloudSecurity in the response.
            Defaults to `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryCloudResourceInventoryResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Cloud Resource Inventory
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/cloudsecurity/compliancefindings:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of compliance findings matching the query from the cloud
        security provider.


        **Operation ID:** `cloudsecurity_query_compliance_findings`
      operationId: cloudsecurity_query_compliance_findings
      tags:
        - Cloudsecurity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of compliance findings to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the CloudSecurity in the response.
            Defaults to `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryComplianceFindingsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Compliance Findings
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/cloudsecurity/threats:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of threat detections that match the query from the cloud
        security provider.


        **Operation ID:** `cloudsecurity_query_threats`
      operationId: cloudsecurity_query_threats
      tags:
        - Cloudsecurity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of threats to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the CloudSecurity in the response.
            Defaults to `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryCloudSecurityThreatsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Threats
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/edr/endpoints:
    get:
      description: >-
        Returns a list of endpoint assets matching the query from the
        token-linked EDR source.


        **Operation ID:** `edr_query_endpoints`
      operationId: edr_query_endpoints
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of endpoint assets to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryEndpointsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Endpoints
      security:
        - BearerAuth: []
  /v1/edr/endpoints/{id}:
    get:
      description: >-
        Gets a single endpoint assets matching the UID from the token-linked EDR
        source.


        **Operation ID:** `edr_get_endpoint`
      operationId: edr_get_endpoint
      tags:
        - Edr
      parameters:
        - name: id
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetEndpointResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Endpoint
      security:
        - BearerAuth: []
  /v1/edr/applications:
    get:
      description: >-
        Returns a list of applications matching the query from the token-linked
        EDR source.


        **Operation ID:** `edr_query_applications`
      operationId: edr_query_applications
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of applications to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryApplicationsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Applications
      security:
        - BearerAuth: []
  /v1/edr/endpoints/actions/quarantine:
    post:
      description: >-
        Connect or disconnect one or more endpoints assets to the network,
        allowing or disallowing connections.


        **Operation ID:** `edr_network_quarantine`
      operationId: edr_network_quarantine
      tags:
        - Edr
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NetworkQuarantineResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Quarantine Endpoints
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NetworkQuarantineRequest'
  /v1/edr/threats:
    get:
      description: >-
        Returns a list of threats that match the query from the token-linked EDR
        source.


        **Operation ID:** `edr_query_threatevents`
      operationId: edr_query_threatevents
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of threats to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the EDR in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryThreatsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Threat Events
      security:
        - BearerAuth: []
  /v1/edr/alerts:
    get:
      description: >-
        Returns a list of alerts that match the query from the token-linked EDR
        source.


        **Operation ID:** `edr_query_alerts`
      operationId: edr_query_alerts
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of threats to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the EDR in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAlertsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Alerts
      security:
        - BearerAuth: []
  /v1/edr/iocs:
    get:
      description: >-
        Returns a list of iocs that match the query from the token-linked EDR
        source.


        **Operation ID:** `edr_query_iocs`
      operationId: edr_query_iocs
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of threats to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the EDR in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryIocsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query IOCs
      security:
        - BearerAuth: []
    post:
      description: |-
        Creates a list of iocs that match the stix input for the EDR source.

        **Operation ID:** `edr_create_iocs`
      operationId: edr_create_iocs
      tags:
        - Edr
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIocsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create IOCs
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIocsRequest'
    delete:
      description: |-
        Deletes a list of iocs that match the input of ids in the query param

        **Operation ID:** `edr_delete_iocs`
      operationId: edr_delete_iocs
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: ids
          in: query
          description: list of ids to delete
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteIocsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Delete IOCs
      security:
        - BearerAuth: []
  /v1/edr/posture_score:
    get:
      description: >-
        Returns the posture score of the endpoint assets that match the query
        from the token-linked EDR source.


        **Operation ID:** `edr_query_posture_score`
      operationId: edr_query_posture_score
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of scores for endpoints to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `name`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[asc]` will sort the results by
            `name` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the EDR in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryPostureScoreResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Posture Score
      security:
        - BearerAuth: []
  /v1/edr/edr_events:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of EDR events that match the query from the token-linked
        EDR source.


        **Operation ID:** `edr_query_edr_events`
      operationId: edr_query_edr_events
      tags:
        - Edr
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: passthrough-param
          in: query
          description: >-
            Provider-specific query to pass through to the EDR. This is useful
            for advanced queries that require additional filtering.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: Filter events. Multiple filters can be provided.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the EDR in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
        - name: limit
          in: query
          description: Number of events to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. To control the direction of
            the sorting, append

            `[asc]` or `[desc]` to the field name. For example, `timestamp[asc]`
            will sort the results by `timestamp` in ascending order.

            The ordering defaults to `asc` if not specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryEdrEventsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query EDR Events
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/hooks:
    post:
      description: >-
        Proxy webhook messages from webhook providers to webhook recievers. For
        exact webhook implementations please refer to providers e.g. Ticketing.
        This is just an API call used in that context, not a standalone
        implementation.


        **Operation ID:** `hooks_proxy`
      operationId: hooks_proxy
      tags:
        - Hooks
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: token
          in: query
          description: >-
            Optional: if you can't use the HTTP Authorization Bearer, specify
            integration access token here.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Proxy Webhook
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema: {}
  /v1/hooks/passthrough/{webHookCursor}:
    post:
      description: >-
        Proxy webhook messages from webhook providers to webhook recievers. For
        exact webhook implementations please refer to providers e.g. Ticketing.
        This is just an API call used in that context, not a standalone
        implementation.


        **Operation ID:** `hooks_passthrough`
      operationId: hooks_passthrough
      tags:
        - Hooks
      parameters:
        - name: webHookCursor
          in: path
          required: true
          schema:
            type: string
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Open Proxy Webhook
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema: {}
  /v1/identity/audit:
    get:
      description: |-
        Returns a list of `Event` objects from the token-linked audit log.

        **Operation ID:** `identity_query_audit_log`
      operationId: identity_query_audit_log
      tags:
        - Identity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of events to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `time`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `time[asc]` will sort the results by
            `time` in ascending order. The ordering defaults to `asc` if not
            specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryIdentityAuditLogResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Audit Log
      security:
        - BearerAuth: []
  /v1/identity/users:
    get:
      description: >-
        Returns a list of `User` objects wrapped in the OCSF Entity Management
        event of type Read from the token-linked identity provider.


        **Operation ID:** `identity_query_users`
      operationId: identity_query_users
      tags:
        - Identity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of users to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `uid`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `email_addr[asc]` will sort the results
            by `email_addr` in ascending order. The ordering defaults to `asc`
            if not specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryUsersResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Users
      security:
        - BearerAuth: []
  /v1/identity/users/{userId}:
    get:
      description: >-
        Returns a `User` object wrapped in an OCSF Entity Management event of
        type Read from the token-linked identity provider. Depending

        on the providers offerings, this may include additional user
        information, such as the user's current groups and roles.


        **Operation ID:** `identity_get_user`
      operationId: identity_get_user
      tags:
        - Identity
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/UserId'
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get User
      security:
        - BearerAuth: []
  /v1/identity/groups:
    get:
      description: >-
        Returns a list of `Group` objects wrapped in the OCSF Entity Management
        event of type Read from the token-linked identity provider.


        **Operation ID:** `identity_query_groups`
      operationId: identity_query_groups
      tags:
        - Identity
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of users to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `uid`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `email_addr[asc]` will sort the results
            by `email_addr` in ascending order. The ordering defaults to `asc`
            if not specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryGroupsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Groups
      security:
        - BearerAuth: []
  /v1/identity/groups/{groupId}:
    get:
      description: >-
        Returns a `Group` object wrapped in an OCSF Entity Management event of
        type Read from the token-linked identity provider. Depending

        on the providers offerings, this may include additional group
        information, such as the roles assigned.


        **Operation ID:** `identity_get_group`
      operationId: identity_get_group
      tags:
        - Identity
      parameters:
        - name: groupId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/GroupId'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetGroupResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Group
      security:
        - BearerAuth: []
  /v1/identity/groups/{groupId}/members:
    get:
      description: >-
        Returns list of `User` objects wrapped in an OCSF Entity Management
        event of type Read from the token-linked identity provider that are
        members in the group referenced by ID.


        **Operation ID:** `identity_get_group_members`
      operationId: identity_get_group_members
      tags:
        - Identity
      parameters:
        - name: groupId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/GroupId'
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of users to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetGroupMembersResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Group Members
      security:
        - BearerAuth: []
  /v1/identity/users/{userId}/actions/enable:
    post:
      description: |-
        Reenables a disabled user in the identity system based on user ID.

        **Operation ID:** `identity_enable_user`
      operationId: identity_enable_user
      tags:
        - Identity
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/UserId'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Enable User
      security:
        - BearerAuth: []
  /v1/identity/users/{userId}/actions/disable:
    post:
      description: |-
        Disables a user in the identity system based on user ID.

        **Operation ID:** `identity_disable_user`
      operationId: identity_disable_user
      tags:
        - Identity
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/UserId'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Disable User
      security:
        - BearerAuth: []
  /v1/identity/users/{userId}/actions/force_reset_password:
    post:
      description: |-
        Forces a user to reset their password before they can log in again.

        **Operation ID:** `identity_force_user_password_reset`
      operationId: identity_force_user_password_reset
      tags:
        - Identity
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/UserId'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Force User Password Reset
      security:
        - BearerAuth: []
  /v1/identity/users/{userId}/actions/expire_all_sessions:
    post:
      description: |-
        Logs a user out of all current sessions so they must log in again.

        **Operation ID:** `identity_expire_all_user_sessions`
      operationId: identity_expire_all_user_sessions
      tags:
        - Identity
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/UserId'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Expire All User Sessions
      security:
        - BearerAuth: []
  /v1/identity/users/{userId}/picture:
    get:
      description: >-
        {% admonition type="info" name="Pre-Release" %}

        This operation is available for testing but may be unstable. Breaking

        changes are unlikely but may still be necessary.


        Please contact us before using this operation.

        {% /admonition %}

        Returns the profile picture for a user as binary image data. The
        Content-Type header indicates the image format (e.g., image/jpeg,
        image/png).


        **Operation ID:** `identity_get_user_picture`
      operationId: identity_get_user_picture
      tags:
        - Identity
      parameters:
        - name: userId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/UserId'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get User Picture
      security:
        - BearerAuth: []
      x-badges:
        - name: Beta
          color: pre-release
          position: before
  /v1/incident-response/escalation-policies:
    get:
      description: |-
        {% admonition type="warning" name="In Development" %}
        This operation is actively being developed. Breaking changes should be
        expected.

        Please contact us before using this operation.
        {% /admonition %}
        Returns a list of incident response escalation policies.

        **Operation ID:** `incidentresponse_query_escalation_policies`
      operationId: incidentresponse_query_escalation_policies
      tags:
        - Incidentresponse
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of escalation policies to return. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/IncidentResponseQueryEscalationPoliciesResponse
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Escalation Policies
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/incident-response/escalation-policies/{escalationPolicyId}/users-on-call:
    get:
      description: >-
        {% admonition type="warning" name="In Development" %}

        This operation is actively being developed. Breaking changes should be

        expected.


        Please contact us before using this operation.

        {% /admonition %}

        Returns a list of users that are currently on call for an incident
        response escalation policy.


        **Operation ID:**
        `incidentresponse_query_escalation_policy_users_on_call`
      operationId: incidentresponse_query_escalation_policy_users_on_call
      tags:
        - Incidentresponse
      parameters:
        - name: escalationPolicyId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/IncidentResponseQueryEscalationPolicyUsersOnCallResponse
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Escalation Policy Users On Call
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/integration-webhooks:
    post:
      description: |-
        Creates a WebHook for the token-linked Integration.

        **Operation ID:** `integrationWebhooks_create_webhook`
      operationId: integrationWebhooks_create_webhook
      tags:
        - IntegrationWebhooks
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIntegrationWebHookResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Integration WebHook Configuration
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIntegrationWebHookRequest'
    delete:
      description: |-
        Deletes the WebHook matching the token-linked Integration.

        **Operation ID:** `integrationWebhooks_delete_webhook`
      operationId: integrationWebhooks_delete_webhook
      tags:
        - IntegrationWebhooks
      parameters: []
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Delete Integration WebHook Configuration
      security:
        - BearerAuth: []
    get:
      description: |-
        Lists all WebHooks from the token-linked Integration.

        **Operation ID:** `integrationWebhooks_list_webhooks`
      operationId: integrationWebhooks_list_webhooks
      tags:
        - IntegrationWebhooks
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListIntegrationWebHooksResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Integration WebHook Configurations
      security:
        - BearerAuth: []
  /v1/notifications/get/{notificationId}:
    get:
      description: >-
        Returns the `Notification` object matching `{notificationId}` from the
        token-linked `Integration`.


        **Operation ID:** `notifications_get_message`
      operationId: notifications_get_message
      tags:
        - Notifications
      parameters:
        - name: notificationId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetNotificationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Notification
      security:
        - BearerAuth: []
  /v1/notifications/create:
    post:
      description: |-
        Creates a `Notification` object in the token-linked `Integration`.

        **Operation ID:** `notifications_create_message`
      operationId: notifications_create_message
      tags:
        - Notifications
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateNotificationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Notification
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateNotificationRequest'
  /v1/notifications/clear/{notificationId}:
    post:
      description: |-
        Resolves a `Notification` object in the token-linked `Integration`.

        **Operation ID:** `notifications_clear_message`
      operationId: notifications_clear_message
      tags:
        - Notifications
      parameters:
        - name: notificationId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Clear Notification
      security:
        - BearerAuth: []
  /v1/operations/{operationId}:
    get:
      description: |-
        {% admonition type="warning" name="In Development" %}
        This operation is actively being developed. Breaking changes should be
        expected.

        Please contact us before using this operation.
        {% /admonition %}
        Returns the `Asynchronous Operation` object matching `{operationId}`.

        **Operation ID:** `operations_get`
      operationId: operations_get
      tags:
        - Operations
      parameters:
        - name: operationId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOperationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Asynchronous Operation state
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
    post:
      description: |-
        {% admonition type="warning" name="In Development" %}
        This operation is actively being developed. Breaking changes should be
        expected.

        Please contact us before using this operation.
        {% /admonition %}
        Cancels the `Asynchronous Operation` matching `{operationId}`.

        **Operation ID:** `operations_cancel`
      operationId: operations_cancel
      tags:
        - Operations
      parameters:
        - name: operationId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Cancel Asynchronous Operation
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/operations:
    post:
      description: |-
        {% admonition type="warning" name="In Development" %}
        This operation is actively being developed. Breaking changes should be
        expected.

        Please contact us before using this operation.
        {% /admonition %}
        Creates an `Asynchronous Operation` object.

        **Operation ID:** `operations_create`
      operationId: operations_create
      tags:
        - Operations
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateOperationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Asynchronous Operation
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOperationRequest'
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/siem/investigations:
    get:
      description: |-
        Queries investigations

        **Operation ID:** `siem_query_investigations`
      operationId: siem_query_investigations
      tags:
        - Siem
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Cursor to use to retrieve the next page of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: >-
            Number of `Investigation` objects to return in this page. Defaults
            to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: Select a field to order the results by.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: Filter results by this query.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryInvestigationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Investigations
      security:
        - BearerAuth: []
  /v1/siem/investigations/{id}:
    get:
      description: |-
        Retrieves an investigation by ID.

        **Operation ID:** `siem_get_investigation`
      operationId: siem_get_investigation
      tags:
        - Siem
      parameters:
        - name: id
          in: path
          description: ID of the investigation to retrieve.
          required: true
          schema:
            type: string
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetInvestigationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Investigation
      security:
        - BearerAuth: []
    patch:
      description: |-
        Updates an investigation by ID.

        **Operation ID:** `siem_patch_investigation`
      operationId: siem_patch_investigation
      tags:
        - Siem
      parameters:
        - name: id
          in: path
          description: ID of the investigation to update.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetInvestigationResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Patch Investigation
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchInvestigationRequest'
  /v1/siem/investigations/{id}/evidence:
    get:
      description: |-
        Retrieves the evidence for an investigation.

        **Operation ID:** `siem_get_evidence`
      operationId: siem_get_evidence
      tags:
        - Siem
      parameters:
        - name: id
          in: path
          description: ID of the investigation to retrieve evidence for.
          required: true
          schema:
            type: string
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetEvidenceResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Evidence
      security:
        - BearerAuth: []
  /v1/siem/log-providers:
    get:
      description: |-
        Queries available log providers in the source SIEM

        **Operation ID:** `siem_query_log_providers`
      operationId: siem_query_log_providers
      tags:
        - Siem
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Cursor to use to retrieve the next page of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: >-
            Number of log provider objects to return in this page. Defaults to
            100.
          required: false
          schema:
            type: integer
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryLogProvidersResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Log Providers
      security:
        - BearerAuth: []
  /v1/siem/events:
    post:
      description: >-
        Writes a batch of `Event` objects to the SIEM configured with the token
        used for authentication.


        **Operation ID:** `siem_post_events`
      operationId: siem_post_events
      tags:
        - Siem
      parameters: []
      responses:
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSiemEventsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Post Events
      security:
        - BearerAuth: []
      requestBody:
        description: The `Event` object to be sent.
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/Event'
    get:
      description: >-
        Queries events from the SIEM configured with the token used for
        authentication.


        **Operation ID:** `siem_query_events`
      operationId: siem_query_events
      tags:
        - Siem
      parameters:
        - name: cursor
          in: query
          description: Cursor to use to retrieve the next page of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: Number of `Account` objects to return in this page. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `time`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[desc]` will sort the results by
            `name` in descending order. The ordering defaults to `asc` if not
            specified. May be used multiple times to order by multiple fields,
            and the ordering is applied in the order the fields are specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: passthrough-param
          in: query
          description: >-
            Provider-specific query to pass through to the SIEM. This is useful
            for advanced queries that are not

            supported by the API. The keys and values are provider-specific. For
            example, to perform a specific

            query in Rapid7 IDR, you can use the `query: "{advanced query}"`
            key-value pair.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. This is useful
            for debugging and troubleshooting. Defaults to `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QuerySiemEventsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Events
      security:
        - BearerAuth: []
  /v1/siem/alerts:
    get:
      description: >-
        Queries alerts from the SIEM configured with the token used for
        authentication.


        **Operation ID:** `siem_query_alerts`
      operationId: siem_query_alerts
      tags:
        - Siem
      parameters:
        - name: cursor
          in: query
          description: Cursor to use to retrieve the next page of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: Number of `Account` objects to return in this page. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `time`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[desc]` will sort the results by
            `name` in descending order. The ordering defaults to `asc` if not
            specified. May be used multiple times to order by multiple fields,
            and the ordering is applied in the order the fields are specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. This is useful
            for debugging and troubleshooting. Defaults to `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QuerySiemAlertsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Alerts
      security:
        - BearerAuth: []
  /v1/siem/alerts/{id}:
    get:
      description: |-
        Retrieves an alert by ID.

        **Operation ID:** `siem_get_alert`
      operationId: siem_get_alert
      tags:
        - Siem
      parameters:
        - name: id
          in: path
          description: ID of the alert to retrieve.
          required: true
          schema:
            type: string
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: include_raw_data
          in: query
          description: >-
            Include the raw data from the SIEM in the response. Defaults to
            `false`.
          required: false
          schema:
            type: boolean
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetAlertResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Alert
      security:
        - BearerAuth: []
  /v1/sink/events:
    post:
      description: >-
        Writes a batch of `Event` objects to the Sink configured with the token
        used for authentication.


        **Operation ID:** `sink_post_events`
      operationId: sink_post_events
      tags:
        - Sink
      parameters:
        - name: location
          in: query
          description: >-
            Updates the path or queue name for the sink. If not provided, the
            default path or queue name is used. When provided, the path or queue
            name is appended to the default path or queue name.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '202':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateSinkEventsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Post Events
      security:
        - BearerAuth: []
      requestBody:
        description: The `Event` object to be sent.
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/Event'
  /v1/storage/folders/{path}:
    get:
      description: |-
        Returns a list of contents from the token-linked `Integration`.

        **Operation ID:** `storage_list_files`
      operationId: storage_list_files
      tags:
        - Storage
      parameters:
        - name: path
          in: path
          required: true
          schema:
            type: string
        - name: cursor
          in: query
          description: Cursor to fetch the next set of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: Number of results to return. Default is 50.
          required: false
          schema:
            type: integer
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListStorageResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Files
      security:
        - BearerAuth: []
  /v1/storage/files/{path}:
    post:
      description: >-
        Uploads a file from the provided `{path}` to the token-linked
        `Integration`.


        **Operation ID:** `storage_upload_file`
      operationId: storage_upload_file
      tags:
        - Storage
      parameters:
        - name: path
          in: path
          required: true
          schema:
            type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Upload File
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
    get:
      description: >-
        Downloads a file from the provided `{path}` in the token-linked
        `Integration`.


        **Operation ID:** `storage_download_file`
      operationId: storage_download_file
      tags:
        - Storage
      parameters:
        - name: path
          in: path
          required: true
          schema:
            type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Download File
      security:
        - BearerAuth: []
    delete:
      description: >-
        Deletes a file from the provided `{path}` in the token-linked
        `Integration`.


        **Operation ID:** `storage_delete_file`
      operationId: storage_delete_file
      tags:
        - Storage
      parameters:
        - name: path
          in: path
          required: true
          schema:
            type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Delete File
      security:
        - BearerAuth: []
  /v1/ticketing/remote-fields:
    get:
      description: >-
        List all remote fields for all Projects in a ticketing integration. The
        response will include a list of fields for each issue type in the
        ticketing provider.


        **Operation ID:** `ticketing_list_remote_fields`
      operationId: ticketing_list_remote_fields
      tags:
        - Ticketing
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListRemoteFieldsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Remote Fields
      security:
        - BearerAuth: []
  /v1/ticketing/projects:
    get:
      description: >-
        Returns a list of `Projects` from the token-linked `Integration`.
        Tickets must be created and retrieved within the context of a specific
        Project.


        **Operation ID:** `ticketing_list_projects`
      operationId: ticketing_list_projects
      tags:
        - Ticketing
      parameters:
        - name: cursor
          in: query
          description: Cursor to use to retrieve the next page of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: Number of `Projects` objects to return in this page. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListProjectsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Projects
      security:
        - BearerAuth: []
  /v1/ticketing/tickets:
    get:
      description: |-
        Returns a list of `Ticket` objects from the token-linked `Integration`.

        **Operation ID:** `ticketing_query_tickets`
      operationId: ticketing_query_tickets
      tags:
        - Ticketing
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: cursor
          in: query
          description: Cursor to use to retrieve the next page of results.
          required: false
          schema:
            type: string
            nullable: true
        - name: limit
          in: query
          description: Number of `Account` objects to return in this page. Defaults to 100.
          required: false
          schema:
            type: integer
            nullable: true
        - name: order
          in: query
          description: >-
            Select a field to order the results by. Defaults to `time`. To
            control the direction of the sorting, append `[asc]` or `[desc]` to
            the field name. For example, `name[desc]` will sort the results by
            `name` in descending order. The ordering defaults to `asc` if not
            specified. May be used multiple times to order by multiple fields,
            and the ordering is applied in the order the fields are specified.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryTicketsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Tickets
      security:
        - BearerAuth: []
    post:
      description: |-
        Creates a `Ticket` object in the token-linked Integration.

        **Operation ID:** `ticketing_create_ticket`
      operationId: ticketing_create_ticket
      tags:
        - Ticketing
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateTicketResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Ticket
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTicketRequest'
  /v1/ticketing/tickets/{ticketId}:
    get:
      description: >-
        Returns a `Ticket` object matching `{ticketId}` from the token-linked
        `Integration`.


        **Operation ID:** `ticketing_get_ticket`
      operationId: ticketing_get_ticket
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetTicketResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Ticket
      security:
        - BearerAuth: []
    patch:
      description: >-
        Updates the `Ticket` object matching `{ticketId}` in the token-linked
        `Integration`.


        **Operation ID:** `ticketing_patch_ticket`
      operationId: ticketing_patch_ticket
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PatchTicketResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Patch Ticket
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/PatchOperation'
  /v1/ticketing/attachments/{ticketId}:
    post:
      description: >-
        [beta: currently supported by Jira] Creates an `Attachment` for the
        ticket with id `{ticketId}` in the token-linked `Integration`.


        **Operation ID:** `ticketing_create_attachment`
      operationId: ticketing_create_attachment
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAttachmentResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Attachment
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAttachmentRequest'
    get:
      description: >-
        [beta: currently supported by Jira] Returns metadata for all Attachments
        for a `Ticket` object matching `{ticketId}` from the token-linked
        `Integration`.


        **Operation ID:** `ticketing_list_attachments_metadata`
      operationId: ticketing_list_attachments_metadata
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAttachmentsMetadataResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Attachments Metadata
      security:
        - BearerAuth: []
  /v1/ticketing/attachments/{ticketId}/{attachmentId}/download:
    get:
      description: >-
        [beta: currently supported by Jira] Downloads the Attachment object
        matching {attachmentId} for the Ticket matching {tickedId} from the
        token-linked Integration.


        **Operation ID:** `ticketing_download_attachment`
      operationId: ticketing_download_attachment
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: attachmentId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DownloadAttachmentResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Download Attachment
      security:
        - BearerAuth: []
  /v1/ticketing/attachments/{ticketId}/{attachmentId}:
    delete:
      description: >-
        [beta: currently supported by Jira] Deletes the Attachment object
        matching {attachmentId} for the Ticket matching {tickedId} from the
        token-linked Integration.


        **Operation ID:** `ticketing_delete_attachment`
      operationId: ticketing_delete_attachment
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: attachmentId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Delete Attachment
      security:
        - BearerAuth: []
  /v1/ticketing/tickets/{ticketId}/comments:
    get:
      description: >-
        Lists all comments for the ticket matching {ticketId} from the
        token-linked Integration.


        **Operation ID:** `ticketing_list_comments`
      operationId: ticketing_list_comments
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCommentsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Comments
      security:
        - BearerAuth: []
    post:
      description: >-
        Creates a comment on the ticket matching {ticketId} from the
        token-linked Integration.


        **Operation ID:** `ticketing_create_comment`
      operationId: ticketing_create_comment
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateCommentResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Comment
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCommentRequest'
  /v1/ticketing/tickets/{ticketId}/comments/{commentId}:
    delete:
      description: >-
        Deletes the comment matching {commentId} form the ticket matching
        {ticketId} from the token-linked Integration.


        **Operation ID:** `ticketing_delete_comment`
      operationId: ticketing_delete_comment
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: commentId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Delete Comment
      security:
        - BearerAuth: []
  /v1/ticketing/tickets/{ticketId}/notes:
    post:
      description: >-
        Creates a note on the ticket matching {ticketId} from the token-linked
        Integration.


        **Operation ID:** `ticketing_create_note`
      operationId: ticketing_create_note
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateNoteResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Note
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateNoteRequest'
    get:
      description: >-
        Lists all notes for the ticket matching {ticketId} from the token-linked
        Integration.


        **Operation ID:** `ticketing_list_notes`
      operationId: ticketing_list_notes
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListNotesResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List Notes
      security:
        - BearerAuth: []
  /v1/ticketing/tickets/{ticketId}/notes/{noteId}:
    delete:
      description: >-
        Deletes the note matching {noteId} form the ticket matching {ticketId}
        from the token-linked Integration.


        **Operation ID:** `ticketing_delete_note`
      operationId: ticketing_delete_note
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: noteId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Delete Note
      security:
        - BearerAuth: []
    patch:
      description: >-
        Update a note matching {noteId} title and/or content on the ticket
        matching {ticketId} from the token-linked Integration.


        **Operation ID:** `ticketing_patch_note`
      operationId: ticketing_patch_note
      tags:
        - Ticketing
      parameters:
        - name: ticketId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: noteId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PatchNoteResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Patch Note
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/PatchOperation'
  /v1/ticketing/escalation-policies:
    get:
      description: |-
        Returns a list of escalation policies.

        **Operation ID:** `ticketing_query_escalation_policies`
      operationId: ticketing_query_escalation_policies
      tags:
        - Ticketing
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of escalation policies to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to our Filtering Guide. Defaults to no filter. If used more
            than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryEscalationPoliciesResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Escalation Policies
      security:
        - BearerAuth: []
  /v1/ticketing/escalation-policies/{escalationPolicyId}/on-call:
    get:
      description: |-
        Returns a list of all on-call agents for an escalation policy.

        **Operation ID:** `ticketing_list_on_call`
      operationId: ticketing_list_on_call
      tags:
        - Ticketing
      parameters:
        - name: escalationPolicyId
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/Id'
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListOnCallResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: List On Call Agents
      security:
        - BearerAuth: []
  /v1/vulnerabilities/findings:
    get:
      description: |-
        Query vulnerability findings

        **Operation ID:** `vulnerabilities_query_findings`
      operationId: vulnerabilities_query_findings
      tags:
        - Vulnerabilities
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of finding reports to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to the Vulnerability Filtering Guide. Defaults to no filter.
            If used more than once, the queries are ANDed together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryFindingsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Findings
      security:
        - BearerAuth: []
  /v1/vulnerabilities/findings/bulk:
    post:
      description: |-
        Create findings (bulk) in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_create_findings`
      operationId: vulnerabilities_create_findings
      tags:
        - Vulnerabilities
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateFindingsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Findings
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateFindingsRequest'
  /v1/vulnerabilities/findings/{findingId}:
    put:
      description: |-
        update a finding in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_update_finding`
      operationId: vulnerabilities_update_finding
      tags:
        - Vulnerabilities
      parameters:
        - name: findingId
          in: path
          description: >-
            Uid of the Finding (URL encoded). This will be `finding.uid` in the
            OCSF model.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: ''
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Update Finding
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFindingRequest'
  /v1/vulnerabilities/assets:
    get:
      description: |-
        Query assets in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_query_assets`
      operationId: vulnerabilities_query_assets
      tags:
        - Vulnerabilities
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of assets to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
        - name: filter
          in: query
          description: >-
            Filter results by this query. For more information on filtering,
            refer to the Vulnerability Filtering Guide.

            Defaults to no filter. If used more than once, the queries are ANDed
            together.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAssetsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Assets
      security:
        - BearerAuth: []
    post:
      description: |-
        Create assets in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_create_asset`
      operationId: vulnerabilities_create_asset
      tags:
        - Vulnerabilities
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAssetResponse'
                nullable: true
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Create Asset
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAssetRequest'
  /v1/vulnerabilities/assets/{assetId}:
    put:
      description: |-
        update an asset in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_update_asset`
      operationId: vulnerabilities_update_asset
      tags:
        - Vulnerabilities
      parameters:
        - name: assetId
          in: path
          description: Uid of the Asset. This will be `devices.uid` in the OCSF model.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Update Asset
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAssetRequest'
  /v1/vulnerabilities/scans:
    get:
      description: |-
        Query scans in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_query_scans`
      operationId: vulnerabilities_query_scans
      tags:
        - Vulnerabilities
      parameters:
        - name: meta
          in: query
          description: >-
            Add metadata to the response by invoking meta functions.
            Documentation for meta functions is available at
            https://docs.synqly.com/api-reference/meta-functions. Not all meta
            function are available at every endpoint.
          required: false
          schema:
            type: array
            items:
              type: string
              nullable: true
        - name: limit
          in: query
          description: Number of scans to return. Defaults to 50.
          required: false
          schema:
            type: integer
            nullable: true
        - name: cursor
          in: query
          description: Start search from cursor position.
          required: false
          schema:
            type: string
            nullable: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryScansResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Query Scans
      security:
        - BearerAuth: []
    post:
      description: |-
        {% admonition type="warning" name="In Development" %}
        This operation is actively being developed. Breaking changes should be
        expected.

        Please contact us before using this operation.
        {% /admonition %}
        Upload a scan in a vulnerability scanning system

        **Operation ID:** `vulnerabilities_upload_scan`
      operationId: vulnerabilities_upload_scan
      tags:
        - Vulnerabilities
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UploadScanResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Upload Scan
      security:
        - BearerAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UploadScanRequest'
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/vulnerabilities/scans/{scan_id}/activity:
    get:
      description: |-
        Get a list of activity generated by a configured scan.

        **Operation ID:** `vulnerabilities_get_scan_activity`
      operationId: vulnerabilities_get_scan_activity
      tags:
        - Vulnerabilities
      parameters:
        - name: scan_id
          in: path
          description: ID of the scan to get its activity.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetScanActivityResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Scan Activity
      security:
        - BearerAuth: []
  /v1/vulnerabilities/scans/{scan_id}/status:
    get:
      description: |-
        {% admonition type="warning" name="In Development" %}
        This operation is actively being developed. Breaking changes should be
        expected.

        Please contact us before using this operation.
        {% /admonition %}
        Get the status of a upload scan

        **Operation ID:** `vulnerabilities_get_scan_status`
      operationId: vulnerabilities_get_scan_status
      tags:
        - Vulnerabilities
      parameters:
        - name: scan_id
          in: path
          description: ID of the scan to get the status of.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetScanStatusResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '401':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '403':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '404':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '405':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '409':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '415':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '429':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '500':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '501':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '502':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '503':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
        '504':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Scan Status
      security:
        - BearerAuth: []
      x-badges:
        - name: Alpha
          color: in-development
          position: before
  /v1/vulnerabilities/labels:
    get:
      description: |-
        Get labels from an asset inventory system

        **Operation ID:** `vulnerabilities_get_labels`
      operationId: vulnerabilities_get_labels
      tags:
        - Vulnerabilities
      parameters: []
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetLabelsResponse'
        '400':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Problem'
      summary: Get Labels
      security:
        - BearerAuth: []
components:
  schemas:
    ApplicationId:
      title: ApplicationId
      $ref: '#/components/schemas/Id'
      description: The unique identifier of the application
    FindingId:
      title: FindingId
      $ref: '#/components/schemas/Id'
      description: The unique identifier of the finding
    AppSecApplication:
      title: AppSecApplication
      $ref: >-
        #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplication
      description: >-
        An application describes the details for an inventoried application as
        reported by an Application Security tool or other Developer-centric
        tooling. Applications can be defined as Github repositories or other
        code-centric resources.
    AppSecPostureFinding:
      title: AppSecPostureFinding
      $ref: >-
        #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
      description: An application security posture finding
    AppSecQueryFindingsResponse:
      title: AppSecQueryFindingsResponse
      type: object
      description: >-
        The combined result of an application's finding and the application
        details from the token-linked application security integration.
      properties:
        result:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecQueryApplicationsResponse:
      title: AppSecQueryApplicationsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplication
          description: List of applications
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecQueryApplicationFindingsResponse:
      title: AppSecQueryApplicationFindingsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
          description: List of application findings
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecGetApplicationFindingDetailsResponse:
      title: AppSecGetApplicationFindingDetailsResponse
      type: object
      properties:
        result:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
          description: Details of an application's finding
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecQueryApplicationsResponseGeneric:
      title: AppSecQueryApplicationsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of applications
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecQueryApplicationFindingsResponseGeneric:
      title: AppSecQueryApplicationFindingsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of application findings
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecQueryFindingsResponseGeneric:
      title: AppSecQueryFindingsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of findings and applications results
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    AppSecGetApplicationFindingDetailsResponseGeneric:
      title: AppSecGetApplicationFindingDetailsResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: Details of the application finding
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    Device:
      title: Device
      $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
      description: >-
        Device inventory information. Represented by OCSF Device Inventory Info
        class (class_uid 5001).
    QueryDevicesResponse:
      title: QueryDevicesResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateDeviceRequest:
      title: CreateDeviceRequest
      type: object
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
      required:
        - device
    CreateDeviceResponse:
      title: CreateDeviceResponse
      type: object
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
      required:
        - device
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetLabelsResponse:
      title: GetLabelsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Label'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    Label:
      title: Label
      type: object
      properties:
        key:
          type: string
          nullable: true
        value:
          type: string
      required:
        - value
    QueryDevicesResponseGeneric:
      title: QueryDevicesResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of devices
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateDeviceResponseGeneric:
      title: CreateDeviceResponseGeneric
      type: object
      properties:
        device:
          type: object
          additionalProperties: true
      required:
        - device
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetLabelsResponseGeneric:
      title: GetLabelsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryComplianceFindingsResponse:
      title: QueryComplianceFindingsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingComplianceFinding'
          description: List of compliance findings that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryCloudResourceInventoryResponse:
      title: QueryCloudResourceInventoryResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo
          description: List of cloud resources that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryIomsResponse:
      title: QueryIomsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingComplianceFinding'
          description: List of IOM findings that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryEventsResponse:
      title: QueryEventsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Event'
          description: List of events that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryCloudSecurityThreatsResponse:
      title: QueryCloudSecurityThreatsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding'
          description: List of cloud security threats that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryCloudSecurityThreatsResponseGeneric:
      title: QueryCloudSecurityThreatsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of cloud security threats that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryComplianceFindingsResponseGeneric:
      title: QueryComplianceFindingsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of compliance findings that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryCloudResourceInventoryResponseGeneric:
      title: QueryCloudResourceInventoryResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of cloud resources that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryIomsResponseGeneric:
      title: QueryIomsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of IOM findings that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryEventsResponseGeneric:
      title: QueryEventsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of events that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    Id:
      title: Id
      type: string
    Base:
      title: Base
      type: object
      properties:
        name:
          type: string
          description: Human-readable name for this resource
        created_at:
          type: string
          format: date-time
          description: Time object was originally created
        updated_at:
          type: string
          format: date-time
          description: Last time object was updated
      required:
        - name
        - created_at
        - updated_at
    Problem:
      title: Problem
      type: object
      description: >-
        Generic base type for problems in Synqly. This object carries both
        machine-readable data as well as information intended for display
        purposes.
      properties:
        type:
          $ref: '#/components/schemas/ProblemType'
          nullable: true
        occurred_at:
          type: string
          format: date-time
          description: The date and time the problem occurred.
        status:
          type: integer
          description: >-
            The HTTP status code of the problem. Matches the HTTP response code
            sent by the server.
        instance:
          type: string
          description: >-
            A URI reference that identifies the specific occurrence of the
            problem. It may or may not yield further information if
            dereferenced.
        cause:
          type: array
          items:
            $ref: '#/components/schemas/ProblemCause'
          nullable: true
          description: >-
            A list of the root cause(s) for this problem occurrence. Includes at
            minimum one root cause, and is otherwise an unordered list of
            causes.
      required:
        - occurred_at
        - status
        - instance
      allOf:
        - $ref: '#/components/schemas/ProblemDetails'
    ProblemCause:
      title: ProblemCause
      type: object
      properties:
        type:
          $ref: '#/components/schemas/ProblemType'
      required:
        - type
      allOf:
        - $ref: '#/components/schemas/ProblemDetails'
    ProblemType:
      title: ProblemType
      type: string
      description: >-
        A URI reference that identifies the type of problem that occurred. When
        the URI scheme is HTTP(s), it may or may not be possible to deference
        the URL to a display-friendly description of the problem type.
    ProblemDetails:
      title: ProblemDetails
      type: object
      properties:
        message:
          type: string
          description: A short, display-friendly summary of the problem.
        detail:
          type: string
          nullable: true
          description: >-
            A display-friendly and more detailed explanation of the problem. It
            may offer additional contextual detail, but may also be just a
            generic description of the problem.
        remediation:
          type: string
          nullable: true
          description: >-
            A display-friendly explanation for how to remediate the problem.
            This field may be omitted in case there are multiple problems, each
            with its own remediation, or if no remediation is possible.
        context:
          $ref: '#/components/schemas/ProblemContext'
          nullable: true
          description: >-
            Additional context providing further detail about the problem, such
            as a problematic input parameter and/or a list of related resources.
      required:
        - message
    ProblemContext:
      title: ProblemContext
      type: object
      properties:
        parameter:
          $ref: '#/components/schemas/ProblematicParameter'
          nullable: true
          description: >-
            If the problem is related to a `query`, `header`, `path` or `body`
            parameter, this field will describe the problematic parameter and
            where to find it.
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ResourceReference'
          nullable: true
        raw_error:
          type: string
          nullable: true
          description: >-
            If available this represents the underlying raw error, for example
            an error response from a Provider.
        provider_details:
          type: object
          additionalProperties:
            type: string
          nullable: true
          description: >-
            If available this represents the underlying details from the
            provider. May include the error message, status code, and other
            details.
    ProblematicParameter:
      title: ProblematicParameter
      type: object
      properties:
        id:
          type: string
          description: >-
            If the `location` of the parameter is `body`, this value is always a
            JSON Pointer, otherwise it's the name of the parameter.
        location:
          $ref: '#/components/schemas/ParameterLocation'
          description: >-
            The location of the parameter. Possible values are `query`,
            `header`, `path` or `body`.
        value:
          nullable: true
          description: The given value of the parameter.
      required:
        - id
        - location
    ParameterLocation:
      title: ParameterLocation
      type: string
      enum:
        - header
        - path
        - query
        - body
    ResourceReference:
      title: ResourceReference
      type: object
      properties:
        type:
          $ref: '#/components/schemas/ResourceType'
          description: Type of the related resource.
        id:
          type: string
          description: ID of the related resource.
        rel:
          $ref: '#/components/schemas/ProblemRelation'
          description: The way in which the resource relates to the problem.
      required:
        - type
        - id
        - rel
    ProblemRelation:
      title: ProblemRelation
      type: string
      enum:
        - affected
        - cause
    ResourceType:
      title: ResourceType
      type: string
      enum:
        - account
        - bridge
        - credential
        - integration_point
        - integration
        - member
        - operation
        - organization_webhook
        - role
        - sub_org
        - token
        - transform
    PatchOp:
      title: PatchOp
      type: string
      enum:
        - add
        - copy
        - move
        - remove
        - replace
        - test
    PatchOperation:
      title: PatchOperation
      type: object
      description: >-
        JSON patch to apply. A JSON patch is a list of patch operations. (see
        https://jsonpatch.com/)
      properties:
        op:
          $ref: '#/components/schemas/PatchOp'
          description: >-
            The operation to perform. Supported values are `add`, `copy`,
            `move`, `replace`, `remove`, and `test`.
        path:
          type: string
          description: The path to the field to update. The path is a JSON Pointer.
        from:
          type: string
          nullable: true
          description: >-
            The path to the field to copy from. This is required for `copy` and
            `move` operations.
        value:
          nullable: true
          description: >-
            The value to set the field to. This is required for `add`, `replace`
            and `test` operations.
      required:
        - op
        - path
    QueryCustomResponse:
      title: QueryCustomResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of items in operation
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    PatchCustomRequest:
      title: PatchCustomRequest
      type: array
      items:
        $ref: '#/components/schemas/PatchOperation'
      description: JSON patch to apply to an Id in operation.
    GetCustomResponse:
      title: GetCustomResponse
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: The resources object
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateBatchCustomResponse:
      title: CreateBatchCustomResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: The resources object
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateCustomResponse:
      title: CreateCustomResponse
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: The resource object
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    Application:
      title: Application
      $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo'
      description: >-
        Application information represented by the extended OCSF Software Info
        event. The Product object describes characteristics of a software
        product.
    ThreatEvent:
      title: ThreatEvent
      $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding'
      description: >-
        Threat event information represented by OCSF Threat object. The Threat
        object describes characteristics of a threat event.
    PostureScore:
      title: PostureScore
      $ref: '#/components/schemas/ocsfv1.3.0configstateConfigState'
      description: The posture score of an endpoint asset.
    ConnectionState:
      title: ConnectionState
      type: string
      enum:
        - Connect
        - Disconnect
    NetworkQuarantineRequest:
      title: NetworkQuarantineRequest
      type: object
      properties:
        state:
          $ref: '#/components/schemas/ConnectionState'
          description: >-
            The connection state (Connect or Disconnect) to enforce for the
            provided endpoint IDs.
        endpoint_ids:
          type: array
          items:
            type: string
          description: The list of endpoint IDs to enforce the connection state on.
        comment:
          type: string
          nullable: true
          description: A comment to include with the quarantine action.
      required:
        - state
        - endpoint_ids
    NetworkQuarantineResponse:
      title: NetworkQuarantineResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: string
          description: >-
            The list of endpoint IDs or action IDs that were successfully
            quarantined or unquarantined.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryEndpointsResponse:
      title: QueryEndpointsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
          description: List of endpoint assets that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryApplicationsResponse:
      title: QueryApplicationsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo'
          description: List of applications that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryThreatsResponse:
      title: QueryThreatsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding'
          description: List of threats that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryAlertsResponse:
      title: QueryAlertsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Event'
          description: List of alerts that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryIocsResponse:
      title: QueryIocsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/stixIndicator'
          description: List of iocs that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateIocsRequest:
      title: CreateIocsRequest
      type: object
      properties:
        indicators:
          type: array
          items:
            $ref: '#/components/schemas/stixIndicator'
          description: The list of iocs to create
      required:
        - indicators
    CreateIocsResponse:
      title: CreateIocsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/stixIndicator'
          description: A list of the indicators that were created
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    DeleteIocsResponse:
      title: DeleteIocsResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: string
          description: A list of ids of the iocs that were deleted.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryPostureScoreResponse:
      title: QueryPostureScoreResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateConfigState'
          description: List of posture scores that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetEndpointResponse:
      title: GetEndpointResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
          description: A single endpoint assets that match the Id.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryEdrEventsResponse:
      title: QueryEdrEventsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Event'
          description: List of EDR events that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryEndpointsResponseGeneric:
      title: QueryEndpointsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of endpoint assets that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryApplicationsResponseGeneric:
      title: QueryApplicationsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of applications that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryThreatsResponseGeneric:
      title: QueryThreatsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of threats that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryAlertsResponseGeneric:
      title: QueryAlertsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of alerts that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryIocsResponseGeneric:
      title: QueryIocsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of iocs that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateIocsResponseGeneric:
      title: CreateIocsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: A list of the indicators that were created
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryPostureScoreResponseGeneric:
      title: QueryPostureScoreResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of posture scores that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetEndpointResponseGeneric:
      title: GetEndpointResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: A single endpoint assets that match the Id.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryEdrEventsResponseGeneric:
      title: QueryEdrEventsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of EDR events that match the query.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    BaseResourceRequest:
      title: BaseResourceRequest
      type: object
      properties:
        name:
          type: string
          description: Human-readable name for this resource
      required:
        - name
    OptionValue:
      title: OptionValue
      type: object
      description: >-
        Represents a possible option from a set of choices, such as an enum
        value. The choices may have separate display names and IDs.
      properties:
        id:
          $ref: '#/components/schemas/Id'
        name:
          type: string
      required:
        - id
        - name
    APIResponse:
      title: APIResponse
      type: object
      properties:
        messages:
          $ref: '#/components/schemas/MessagesResponse'
          nullable: true
          description: >-
            Additional messages from the service response that may be helpful to
            the client.
        meta:
          $ref: '#/components/schemas/MetaResponse'
          nullable: true
          description: >-
            Various metadata about the results organized by group, then type,
            then field.
    APIQueryResponse:
      title: APIQueryResponse
      type: object
      properties:
        cursor:
          type: string
          description: Cursor to use to retrieve the next page of results
      required:
        - cursor
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    APIHasStatus:
      title: APIHasStatus
      type: object
      properties:
        status:
          $ref: '#/components/schemas/QueryStatus'
          description: >-
            If the provider supports asynchronous queries and the query is still
            running, this field will be `PENDING` until the query is complete.
            In this case, the client should retry using the provided cursor.
      required:
        - status
    MessagesResponse:
      title: MessagesResponse
      type: object
      properties:
        problems:
          type: array
          items:
            $ref: '#/components/schemas/Problem'
          nullable: true
          description: >-
            Warnings or issues that occurred during processing that did not
            prevent the request from returning, but may indicate a problem or
            issue with expected processing behavior.
    MetaResponse:
      title: MetaResponse
      type: object
      properties:
        stats:
          $ref: '#/components/schemas/MetaStats'
          nullable: true
          description: Statistics about items contained in the response.
        api:
          $ref: '#/components/schemas/MetaApi'
          nullable: true
          description: Information about backing API requests made to fulfill the response.
        mapping:
          $ref: '#/components/schemas/MetaMapping'
          nullable: true
          description: Information about mappings applied during transformation.
    MetaStats:
      title: MetaStats
      type: object
      properties:
        count:
          type: object
          additionalProperties:
            type: integer
            format: int64
          nullable: true
          description: >-
            A count of total response times. If present "\*" will be all items,
            or they can be faceted into specific categories.
    MetaApi:
      title: MetaApi
      type: object
      properties:
        response:
          $ref: '#/components/schemas/MetaApiResponse'
          nullable: true
    MetaApiResponse:
      title: MetaApiResponse
      type: object
      properties:
        primary:
          $ref: '#/components/schemas/MetaApiPrimaryResponse'
          nullable: true
        list:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          nullable: true
          description: All responses from backing API calls, indexed by endpoint URL.
    MetaApiPrimaryResponse:
      title: MetaApiPrimaryResponse
      type: object
      properties:
        endpoint:
          type: string
          description: >-
            The endpoint URL of the primary API request made to fulfill the
            response.
        response:
          type: string
          description: The response from the primary API request.
      required:
        - endpoint
        - response
    MetaMapping:
      title: MetaMapping
      type: object
      properties:
        chains:
          $ref: '#/components/schemas/MetaMappingChains'
          nullable: true
          description: >-
            Mapping chains applied for any transformation that were performed
            during the request.
    MetaMappingChains:
      title: MetaMappingChains
      type: object
      additionalProperties:
        type: array
        items:
          type: string
      description: >-
        The list of mapping chains applied, indexed by operation ID. Each entry
        contains an array of mapping IDs.
    Object:
      title: Object
      type: object
      additionalProperties: true
      description: >-
        The Object type is used to represent an object with arbitrary fields.
        The keys are strings and the values are any type.
    QueryStatus:
      title: QueryStatus
      type: string
      enum:
        - PENDING
        - COMPLETE
    Event:
      title: Event
      oneOf:
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Account Change
            - $ref: '#/components/schemas/ocsfv1.3.0accountchangeAccountChange'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - API Activity
            - $ref: '#/components/schemas/ocsfv1.3.0apiactivityApiActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Application Security Posture Finding
            - $ref: >-
                #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Entity Management
            - $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Authentication
            - $ref: '#/components/schemas/ocsfv1.3.0authenticationAuthentication'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Authorize Session
            - $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAuthorizeSession'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Base Event
            - $ref: '#/components/schemas/ocsfv1.3.0baseeventBaseEvent'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Compliance Finding
            - $ref: >-
                #/components/schemas/ocsfv1.3.0compliancefindingComplianceFinding
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Device Config State
            - $ref: '#/components/schemas/ocsfv1.3.0configstateConfigState'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Detection Finding
            - $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - DNS Activity
            - $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - HTTP Activity
            - $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - File System Activity
            - $ref: '#/components/schemas/ocsfv1.3.0fileactivityFileActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Group Management
            - $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroupManagement'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Incident Finding
            - $ref: '#/components/schemas/ocsfv1.3.0incidentfindingIncidentFinding'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Device Inventory Info
            - $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Module Activity
            - $ref: '#/components/schemas/ocsfv1.3.0moduleactivityModuleActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Network Activity
            - $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Process Activity
            - $ref: '#/components/schemas/ocsfv1.3.0processactivityProcessActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Scan Activity
            - $ref: '#/components/schemas/ocsfv1.3.0scanactivityScanActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Scheduled Job Activity
            - $ref: >-
                #/components/schemas/ocsfv1.3.0scheduledjobactivityScheduledJobActivity
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Security Finding
            - $ref: '#/components/schemas/ocsfv1.3.0securityfindingSecurityFinding'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Software Info
            - $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSoftwareInfo'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - User Access Management
            - $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUserAccess'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Vulnerability Finding
            - $ref: >-
                #/components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Web Resource Access Activity
            - $ref: >-
                #/components/schemas/ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Application Lifecycle
            - $ref: >-
                #/components/schemas/ocsfv1.3.0applicationlifecycleApplicationLifecycle
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - File Hosting Activity
            - $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFileHosting'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Email Activity
            - $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Cloud Activity
            - $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCloudActivity'
          required:
            - class_name
        - type: object
          allOf:
            - type: object
              properties:
                class_name:
                  type: string
                  enum:
                    - Cloud Resources Inventory Info
            - $ref: >-
                #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo
          required:
            - class_name
    TicketingWebhookResponse:
      title: TicketingWebhookResponse
      type: object
      properties:
        ticket_id:
          type: string
          nullable: true
          description: The ID of the ticket in the ticketing system.
        entity_date:
          type: string
          nullable: true
          description: >-
            Date pertiment to webhook operation e.g. if its TicketCreated would
            be creation date. This comes directly from the ticketing system
            without any date formatting changes.
        priority:
          $ref: '#/components/schemas/Priority'
          nullable: true
          description: The priority of the ticket.
        short_description:
          type: string
          nullable: true
          description: Short Description of the ticket in the ticketing system.
        event_type:
          $ref: '#/components/schemas/WebhookEvent'
          nullable: true
          description: The type of event that was sent by the ticketing system.
        raw_payload:
          type: string
          description: >-
            The Raw JSON that was sent by the ticketing system for this webhook
            event.
      required:
        - raw_payload
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryIdentityAuditLogResponse:
      title: QueryIdentityAuditLogResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Event'
          description: >-
            List of events from the audit log. Each event will be one of the
            OCSF Types Account Change, Authentication, or Group Management.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryUsersResponse:
      title: QueryUsersResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
          description: List users wrapped in the OCSF Entity Management event of type Read.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetUserResponse:
      title: GetUserResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryGroupsResponse:
      title: QueryGroupsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
          description: >-
            List groups wrapped in the OCSF Entity Management event of type
            Read.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetGroupResponse:
      title: GetGroupResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetGroupMembersResponse:
      title: GetGroupMembersResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
          description: >-
            List of users wrapped in the OCSF Entity Management event of type
            Read that are members in the group referenced by ID.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    UserId:
      title: UserId
      type: string
      description: The unique identifier for a user in the identity provider's system
    GroupId:
      title: GroupId
      type: string
      description: The unique identifier for a group in the identity provider's system
    QueryIdentityAuditLogResponseGeneric:
      title: QueryIdentityAuditLogResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: >-
            List of events from the audit log. Each event will be one of the
            OCSF Types Account Change, Authentication, or Group Management.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QueryUsersResponseGeneric:
      title: QueryUsersResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List users wrapped in the OCSF Entity Management event of type Read.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetUserResponseGeneric:
      title: GetUserResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryGroupsResponseGeneric:
      title: QueryGroupsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: >-
            List groups wrapped in the OCSF Entity Management event of type
            Read.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetGroupResponseGeneric:
      title: GetGroupResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetGroupMembersResponseGeneric:
      title: GetGroupMembersResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: >-
            List of users wrapped in the OCSF Entity Management event of type
            Read that are members in the group referenced by ID.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    IncidentResponseUserReference:
      title: IncidentResponseUserReference
      type: object
      properties:
        name:
          type: string
          nullable: true
          description: The name of the incident response user being referenced.
        desc:
          type: string
          nullable: true
          description: The description of the incident response user being referenced.
        uid:
          $ref: '#/components/schemas/Id'
          description: >-
            The unique identifier for the incident response user being
            referenced.
        src_url:
          type: string
          nullable: true
          description: >-
            A deep-linked url to the incident response user in a providers
            interface.
      required:
        - uid
    IncidentResponseTeamReference:
      title: IncidentResponseTeamReference
      type: object
      properties:
        name:
          type: string
          nullable: true
          description: The name of the incident response team being referenced.
        desc:
          type: string
          nullable: true
          description: The description of the incident response team being referenced.
        uid:
          $ref: '#/components/schemas/Id'
          description: >-
            The unique identifier for the incident response team being
            referenced.
        src_url:
          type: string
          nullable: true
          description: >-
            A deep-linked url to the incident response team in a providers
            interface.
      required:
        - uid
    IncidentResponseScheduleReference:
      title: IncidentResponseScheduleReference
      type: object
      properties:
        name:
          type: string
          nullable: true
          description: The name of the incident response schedule being referenced.
        desc:
          type: string
          nullable: true
          description: The description of the incident response schedule being referenced.
        uid:
          $ref: '#/components/schemas/Id'
          description: >-
            The unique identifier for the incident response schedule being
            referenced.
        src_url:
          type: string
          nullable: true
          description: >-
            A deep-linked url to the incident response schedule in a providers
            interface.
      required:
        - uid
    IncidentResponseEscalationTargetUnion:
      title: IncidentResponseEscalationTargetUnion
      oneOf:
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_user
            - $ref: '#/components/schemas/IncidentResponseUser'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_team
            - $ref: '#/components/schemas/IncidentResponseTeam'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_schedule
            - $ref: '#/components/schemas/IncidentResponseSchedule'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_user_reference
            - $ref: '#/components/schemas/IncidentResponseUserReference'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_team_reference
            - $ref: '#/components/schemas/IncidentResponseTeamReference'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_schedule_reference
            - $ref: '#/components/schemas/IncidentResponseScheduleReference'
          required:
            - type
    IncidentResponseTeamUnion:
      title: IncidentResponseTeamUnion
      oneOf:
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_team
            - $ref: '#/components/schemas/IncidentResponseTeam'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_team_reference
            - $ref: '#/components/schemas/IncidentResponseTeamReference'
          required:
            - type
    IncidentResponseUserUnion:
      title: IncidentResponseUserUnion
      oneOf:
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_user
            - $ref: '#/components/schemas/IncidentResponseUser'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - incident_response_user_reference
            - $ref: '#/components/schemas/IncidentResponseUserReference'
          required:
            - type
    IncidentResponseUser:
      title: IncidentResponseUser
      type: object
      properties:
        email_addr:
          type: string
          nullable: true
          description: The email address of the incident response user.
        teams:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseTeamUnion'
          nullable: true
          description: >-
            The incident response teams that the incident response user is a
            member of.
        name:
          type: string
          nullable: true
          description: The name of the incident response user.
        uid:
          $ref: '#/components/schemas/Id'
          description: The unique identifier for the incident response user.
        timezone:
          type: string
          nullable: true
          description: >-
            The timezone of the incident response user. This value is
            represented as a IANA timezone string.
        job_title:
          type: string
          nullable: true
          description: The job title of the incident response user.
        src_url:
          type: string
          nullable: true
          description: >-
            A deep-linked url to the incident response user in a providers
            interface.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the incident response user
            schema. The names and values of those attributes are specific to
            each provider.
      required:
        - uid
    IncidentResponseSchedule:
      title: IncidentResponseSchedule
      type: object
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the incident response schedule.
        name:
          type: string
          nullable: true
          description: The name of the incident response schedule.
        src_url:
          type: string
          nullable: true
          description: >-
            A deep-linked url to the incident response schedule in a providers
            interface.
        uid:
          $ref: '#/components/schemas/Id'
          description: The unique identifier for the incident response schedule.
        teams:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseTeamUnion'
          nullable: true
          description: >-
            The incident response teams that own or are a part of the incident
            response schedule.
        users:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseUserUnion'
          nullable: true
          description: >-
            The incident response users that are a part of the incident response
            schedule.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the incident response user
            schema. The names and values of those attributes are specific to
            each provider.
      required:
        - uid
    IncidentResponseTeam:
      title: IncidentResponseTeam
      type: object
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the incident response team.
        name:
          type: string
          nullable: true
          description: The name of the incident response team.
        src_url:
          type: string
          nullable: true
          description: >-
            A deep-linked url to the incident response team in a providers
            interface.
        uid:
          $ref: '#/components/schemas/Id'
          description: The unique identifier for the incident response team.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the incident response user
            schema. The names and values of those attributes are specific to
            each provider.
      required:
        - uid
    IncidentResponseEscalationRule:
      title: IncidentResponseEscalationRule
      type: object
      properties:
        escalation_delay:
          type: integer
          nullable: true
          description: The delay in milliseconds before the next target is notified.
        targets:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseEscalationTargetUnion'
          nullable: true
          description: The targets to notify.
        uid:
          $ref: '#/components/schemas/Id'
          description: The unique identifier for the escalation rule.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the incident response user
            schema. The names and values of those attributes are specific to
            each provider.
      required:
        - uid
    IncidentResponseEscalationPolicy:
      title: IncidentResponseEscalationPolicy
      type: object
      properties:
        created_time:
          type: integer
          nullable: true
          description: >-
            A Unix timestamp in milliseconds representing the time the
            escalation policy was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The human readable time the escalation policy was created.
        desc:
          type: string
          nullable: true
          description: The description of the escalation policy.
        name:
          type: string
          nullable: true
          description: The name of the escalation policy.
        escalation_rules:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseEscalationRule'
          nullable: true
          description: The escalation rules for the escalation policy.
        src_url:
          type: string
          nullable: true
          description: A deep-linked url to the escalation policy in a providers interface.
        teams:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseTeamUnion'
          nullable: true
          description: The teams that own the escalation policy.
        uid:
          $ref: '#/components/schemas/Id'
          description: The unique identifier for the escalation policy.
        updated_time:
          type: integer
          nullable: true
          description: >-
            A Unix timestamp in milliseconds representing the time the
            escalation policy was last updated.
        updated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The human readable time the escalation policy was last updated.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the incident response user
            schema. The names and values of those attributes are specific to
            each provider.
      required:
        - uid
    IncidentResponseQueryEscalationPolicyUsersOnCallResponse:
      title: IncidentResponseQueryEscalationPolicyUsersOnCallResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseUserUnion'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    IncidentResponseQueryEscalationPoliciesResponse:
      title: IncidentResponseQueryEscalationPoliciesResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/IncidentResponseEscalationPolicy'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    IncidentResponseQueryEscalationPolicyUsersOnCallResponseGeneric:
      title: IncidentResponseQueryEscalationPolicyUsersOnCallResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    IncidentResponseQueryEscalationPoliciesResponseGeneric:
      title: IncidentResponseQueryEscalationPoliciesResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateIntegrationWebHookRequest:
      title: CreateIntegrationWebHookRequest
      type: object
      properties:
        project:
          type: string
          description: Project or Table to link the webhook.
      required:
        - project
    CreateIntegrationWebHookResponse:
      title: CreateIntegrationWebHookResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/IntegrationWebHook'
      required:
        - result
    ListIntegrationWebHooksResponse:
      title: ListIntegrationWebHooksResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/IntegrationWebHook'
        url:
          type: string
          description: >-
            Unique URL for this webhook. This is the URL that the end-user can
            use to manually create the webhook in the provider.
      required:
        - result
        - url
    IntegrationWebHookId:
      title: IntegrationWebHookId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for a integration webHook
    IntegrationWebHook:
      title: IntegrationWebHook
      type: object
      description: Integration webhook
      properties:
        id:
          $ref: '#/components/schemas/Id'
        creator:
          type: string
          description: The user who created the webHook.
        enabled:
          type: boolean
          description: Status of the WebHook.
        events:
          type: array
          items:
            type: string
          description: List of events that trigger the WebHook.
        name:
          type: string
          description: A name for the WebHook.
        value:
          type: string
          description: >-
            The content of the webHook, this can be a URL or a specific code, it
            depends on the provider.
        created_at:
          type: string
          format: date-time
          description: The date the WebHook was created.
        updated_at:
          type: string
          format: date-time
          nullable: true
          description: The date the WebHook was last updated.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the WebHook schema. The names
            and values of those attributes are specific to the provider.
      required:
        - id
        - creator
        - enabled
        - events
        - name
        - value
        - created_at
    NotificationId:
      title: NotificationId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for this notification
    NotificationStatus:
      title: NotificationStatus
      type: string
      enum:
        - OPEN
        - CLOSED
    Notification:
      title: Notification
      type: object
      description: Notification object
      properties:
        id:
          $ref: '#/components/schemas/Id'
        summary:
          type: string
          description: Notification summary.
        priority:
          $ref: '#/components/schemas/Priority'
          nullable: true
          description: Notification priority
        notification_status:
          $ref: '#/components/schemas/NotificationStatus'
          nullable: true
          description: Notification status
        project:
          type: string
          nullable: true
          description: Notification project
        status:
          type: string
          nullable: true
          description: The current status of the notification.
        description:
          type: string
          nullable: true
          description: Notification description.
        issue_type:
          type: string
          nullable: true
          description: The notification's type.
        creator:
          type: string
          nullable: true
          description: The user who created this notification.
        assignee:
          type: string
          nullable: true
          description: Who notification is assigned to.
        contact:
          type: string
          nullable: true
          description: The notification contact information.
        tags:
          type: array
          items:
            type: string
          nullable: true
          description: Associate tags with Notification
      required:
        - id
        - summary
      allOf:
        - $ref: '#/components/schemas/Base'
    CreateNotificationRequest:
      title: CreateNotificationRequest
      type: object
      description: >-
        Notification object. With some providers (Slack, Teams), if only the
        `summary` field is populated, the message will be treated as a
        "passthrough notification". In such cases, the `summary` field will be
        used as the entire message, and no further formatting will be applied.
        This is useful if you need to include provider-specific formatting.
      properties:
        name:
          type: string
          nullable: true
          description: This field is deprecated and no longer used.
        summary:
          type: string
          description: Notification summary.
        priority:
          $ref: '#/components/schemas/Priority'
          nullable: true
          description: Notification priority
        project:
          type: string
          nullable: true
          description: Notification project
        status:
          type: string
          nullable: true
          description: The current status of the notification.
        description:
          type: string
          nullable: true
          description: Notification description.
        issue_type:
          type: string
          nullable: true
          description: The notification's type.
        creator:
          type: string
          nullable: true
          description: The user who created this notification.
        assignee:
          type: string
          nullable: true
          description: Who notification is assigned to.
        contact:
          type: string
          nullable: true
          description: The notification contact information.
        tags:
          type: array
          items:
            type: string
          nullable: true
          description: Associate tags with Notification
      required:
        - summary
    CreateNotificationResponse:
      title: CreateNotificationResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Notification'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetNotificationResponse:
      title: GetNotificationResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Notification'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ocsflatestAccountChange:
      title: ocsflatestAccountChange
      $ref: '#/components/schemas/ocsfv1.3.0accountchangeAccountChange'
    ocsflatestApiActivity:
      title: ocsflatestApiActivity
      $ref: '#/components/schemas/ocsfv1.3.0apiactivityApiActivity'
    ocsflatestApplicationSecurityPostureFinding:
      title: ocsflatestApplicationSecurityPostureFinding
      $ref: >-
        #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
    ocsflatestAuthentication:
      title: ocsflatestAuthentication
      $ref: '#/components/schemas/ocsfv1.3.0authenticationAuthentication'
    ocsflatestCloudResourcesInventoryInfo:
      title: ocsflatestCloudResourcesInventoryInfo
      $ref: >-
        #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo
    ocsflatestComplianceFinding:
      title: ocsflatestComplianceFinding
      $ref: '#/components/schemas/ocsfv1.3.0compliancefindingComplianceFinding'
    ocsflatestDetectionFinding:
      title: ocsflatestDetectionFinding
      $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding'
    ocsflatestDnsActivity:
      title: ocsflatestDnsActivity
      $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsActivity'
    ocsflatestEntityManagement:
      title: ocsflatestEntityManagement
      $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEntityManagement'
    ocsflatestFileActivity:
      title: ocsflatestFileActivity
      $ref: '#/components/schemas/ocsfv1.3.0fileactivityFileActivity'
    ocsflatestGroupManagement:
      title: ocsflatestGroupManagement
      $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroupManagement'
    ocsflatestIncidentFinding:
      title: ocsflatestIncidentFinding
      $ref: '#/components/schemas/ocsfv1.3.0incidentfindingIncidentFinding'
    ocsflatestInventoryInfo:
      title: ocsflatestInventoryInfo
      $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
    ocsflatestModuleActivity:
      title: ocsflatestModuleActivity
      $ref: '#/components/schemas/ocsfv1.3.0moduleactivityModuleActivity'
    ocsflatestNetworkActivity:
      title: ocsflatestNetworkActivity
      $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkActivity'
    ocsflatestHttpActivity:
      title: ocsflatestHttpActivity
      $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpActivity'
    ocsflatestProcessActivity:
      title: ocsflatestProcessActivity
      $ref: '#/components/schemas/ocsfv1.3.0processactivityProcessActivity'
    ocsflatestScheduledJobActivity:
      title: ocsflatestScheduledJobActivity
      $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityScheduledJobActivity'
    ocsflatestSecurityFinding:
      title: ocsflatestSecurityFinding
      $ref: '#/components/schemas/ocsfv1.3.0securityfindingSecurityFinding'
    ocsflatestVulnerabilityFinding:
      title: ocsflatestVulnerabilityFinding
      $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding'
    ocsflatestWebResourceAccessActivity:
      title: ocsflatestWebResourceAccessActivity
      $ref: >-
        #/components/schemas/ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity
    ocsflatestFileHostingActivity:
      title: ocsflatestFileHostingActivity
      $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFileHosting'
    ocsflatestEmailActivity:
      title: ocsflatestEmailActivity
      $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailActivity'
    ocsflatestCloudActivity:
      title: ocsflatestCloudActivity
      $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCloudActivity'
    ocsflatestOCSF150Application:
      title: ocsflatestOCSF150Application
      $ref: >-
        #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplication
    ocsfv1.3.0accountchangeEmailAddress:
      title: ocsfv1.3.0accountchangeEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0accountchangeFileName:
      title: ocsfv1.3.0accountchangeFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0accountchangeHash:
      title: ocsfv1.3.0accountchangeHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0accountchangeHostname:
      title: ocsfv1.3.0accountchangeHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0accountchangeIPAddress:
      title: ocsfv1.3.0accountchangeIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0accountchangeMACAddress:
      title: ocsfv1.3.0accountchangeMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0accountchangePort:
      title: ocsfv1.3.0accountchangePort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0accountchangeProcessName:
      title: ocsfv1.3.0accountchangeProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0accountchangeSubnet:
      title: ocsfv1.3.0accountchangeSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0accountchangeTimestamp:
      title: ocsfv1.3.0accountchangeTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0accountchangeURLString:
      title: ocsfv1.3.0accountchangeURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0accountchangeUserName:
      title: ocsfv1.3.0accountchangeUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0accountchangeAccountChange:
      title: ocsfv1.3.0accountchangeAccountChange
      type: object
      description: >-
        Account Change events report when specific user account management tasks
        are performed, such as a user/role being created, changed, deleted,
        renamed, disabled, enabled, locked out or unlocked.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Identity &amp; Access Management</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangePolicy'
          nullable: true
          description: >-
            Details about the IAM policy associated to the Attach/Detach Policy
            activities.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeNetworkEndpoint'
          nullable: true
          description: Details about the source of the IAM activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          description: The user that was a target of an activity.
        user_result:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: >-
            The result of the user account change. It should contain the new
            values of the changed attributes.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
        - user
    ocsfv1.3.0accountchangeActivityId:
      title: ocsfv1.3.0accountchangeActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A user/role was created.

        2 - Enable: A user/role was enabled.

        3 - PasswordChange: An attempt was made to change an account's password.

        4 - PasswordReset: An attempt was made to reset an account's password.

        5 - Disable: A user/role was disabled.

        6 - Delete: A user/role was deleted.

        7 - AttachPolicy: An IAM Policy was attached to a user/role.

        8 - DetachPolicy: An IAM Policy was detached from a user/role.

        9 - Lock: A user account was locked out.

        10 - MFAFactorEnable: An authentication factor was enabled for an
        account.

        11 - MFAFactorDisable: An authentication factor was disabled for an
        account.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeCategoryUid:
      title: ocsfv1.3.0accountchangeCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        3 - AccessManagement: Identity &amp; Access Management (IAM) events
        relate to the supervision of the system's authentication and access
        control model. Examples of such events are the success or failure of
        authentication, granting of authority, password change, entity change,
        privileged use etc.
    ocsfv1.3.0accountchangeClassUid:
      title: ocsfv1.3.0accountchangeClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        3001 - AccountChange: Account Change events report when specific user
        account management tasks are performed, such as a user/role being
        created, changed, deleted, renamed, disabled, enabled, locked out or
        unlocked.
    ocsfv1.3.0accountchangeSeverityId:
      title: ocsfv1.3.0accountchangeSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0accountchangeStatusId:
      title: ocsfv1.3.0accountchangeStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0accountchangeTypeUid:
      title: ocsfv1.3.0accountchangeTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        300100 - Unknown

        300101 - Create: A user/role was created.

        300102 - Enable: A user/role was enabled.

        300103 - PasswordChange: An attempt was made to change an account's
        password.

        300104 - PasswordReset: An attempt was made to reset an account's
        password.

        300105 - Disable: A user/role was disabled.

        300106 - Delete: A user/role was deleted.

        300107 - AttachPolicy: An IAM Policy was attached to a user/role.

        300108 - DetachPolicy: An IAM Policy was detached from a user/role.

        300109 - Lock: A user account was locked out.

        300110 - MFAFactorEnable: An authentication factor was enabled for an
        account.

        300111 - MFAFactorDisable: An authentication factor was disabled for an
        account.

        300199 - Other
    ocsfv1.3.0accountchangeAccount:
      title: ocsfv1.3.0accountchangeAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0accountchangeAccount_TypeId:
      title: ocsfv1.3.0accountchangeAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0accountchangeActor:
      title: ocsfv1.3.0accountchangeActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0accountchangeActor_ActorTypeId:
      title: ocsfv1.3.0accountchangeActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeAffectedCode:
      title: ocsfv1.3.0accountchangeAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0accountchangeAffectedPackage:
      title: ocsfv1.3.0accountchangeAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0accountchangeAffectedPackage_TypeId:
      title: ocsfv1.3.0accountchangeAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeAgent:
      title: ocsfv1.3.0accountchangeAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0accountchangeAgent_TypeId:
      title: ocsfv1.3.0accountchangeAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeApi:
      title: ocsfv1.3.0accountchangeApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0accountchangeAttack:
      title: ocsfv1.3.0accountchangeAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0accountchangeAuthorization:
      title: ocsfv1.3.0accountchangeAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangePolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0accountchangeAutonomousSystem:
      title: ocsfv1.3.0accountchangeAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0accountchangeCertificate:
      title: ocsfv1.3.0accountchangeCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0accountchangeCloud:
      title: ocsfv1.3.0accountchangeCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0accountchangeContainer:
      title: ocsfv1.3.0accountchangeContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0accountchangeCve:
      title: ocsfv1.3.0accountchangeCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0accountchangeCvss:
      title: ocsfv1.3.0accountchangeCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0accountchangeCvss_Depth:
      title: ocsfv1.3.0accountchangeCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0accountchangeCwe:
      title: ocsfv1.3.0accountchangeCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0accountchangeDevice:
      title: ocsfv1.3.0accountchangeDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0accountchangeDevice_NetworkStatusId:
      title: ocsfv1.3.0accountchangeDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0accountchangeDevice_RiskLevelId:
      title: ocsfv1.3.0accountchangeDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0accountchangeDevice_TypeId:
      title: ocsfv1.3.0accountchangeDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0accountchangeDeviceHwInfo:
      title: ocsfv1.3.0accountchangeDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0accountchangeDigitalSignature:
      title: ocsfv1.3.0accountchangeDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0accountchangeDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0accountchangeDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0accountchangeDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0accountchangeDigitalSignature_StateId:
      title: ocsfv1.3.0accountchangeDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0accountchangeDisplay:
      title: ocsfv1.3.0accountchangeDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0accountchangeDnsAnswer:
      title: ocsfv1.3.0accountchangeDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0accountchangeDnsAnswer_FlagIds:
      title: ocsfv1.3.0accountchangeDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0accountchangeDomainContact:
      title: ocsfv1.3.0accountchangeDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0accountchangeDomainContact_TypeId:
      title: ocsfv1.3.0accountchangeDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeEmail:
      title: ocsfv1.3.0accountchangeEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0accountchangeEmailAuth:
      title: ocsfv1.3.0accountchangeEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0accountchangeEnrichment:
      title: ocsfv1.3.0accountchangeEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0accountchangeEpss:
      title: ocsfv1.3.0accountchangeEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0accountchangeExtension:
      title: ocsfv1.3.0accountchangeExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0accountchangeFeature:
      title: ocsfv1.3.0accountchangeFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0accountchangeFile:
      title: ocsfv1.3.0accountchangeFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0accountchangeFile_ConfidentialityId:
      title: ocsfv1.3.0accountchangeFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeFile_TypeId:
      title: ocsfv1.3.0accountchangeFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeFingerprint:
      title: ocsfv1.3.0accountchangeFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0accountchangeFingerprint_AlgorithmId:
      title: ocsfv1.3.0accountchangeFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0accountchangeGroup:
      title: ocsfv1.3.0accountchangeGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0accountchangeHttpHeader:
      title: ocsfv1.3.0accountchangeHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0accountchangeHttpRequest:
      title: ocsfv1.3.0accountchangeHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0accountchangeHttpRequest_HttpMethod:
      title: ocsfv1.3.0accountchangeHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0accountchangeIdp:
      title: ocsfv1.3.0accountchangeIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0accountchangeImage:
      title: ocsfv1.3.0accountchangeImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0accountchangeKbArticle:
      title: ocsfv1.3.0accountchangeKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0accountchangeKbArticle_InstallStateId:
      title: ocsfv1.3.0accountchangeKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeKeyboardInfo:
      title: ocsfv1.3.0accountchangeKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0accountchangeKillChainPhase:
      title: ocsfv1.3.0accountchangeKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0accountchangeKillChainPhase_PhaseId:
      title: ocsfv1.3.0accountchangeKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0accountchangeLdapPerson:
      title: ocsfv1.3.0accountchangeLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0accountchangeLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0accountchangeLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0accountchangeLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeLocation:
      title: ocsfv1.3.0accountchangeLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0accountchangeLogger:
      title: ocsfv1.3.0accountchangeLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0accountchangeMetadata:
      title: ocsfv1.3.0accountchangeMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0accountchangeMetric:
      title: ocsfv1.3.0accountchangeMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0accountchangeNetworkEndpoint:
      title: ocsfv1.3.0accountchangeNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangePort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0accountchangeNetworkEndpoint_TypeId:
      title: ocsfv1.3.0accountchangeNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0accountchangeNetworkInterface:
      title: ocsfv1.3.0accountchangeNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0accountchangeNetworkInterface_TypeId:
      title: ocsfv1.3.0accountchangeNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeNetworkProxy:
      title: ocsfv1.3.0accountchangeNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangePort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0accountchangeNetworkProxy_TypeId:
      title: ocsfv1.3.0accountchangeNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0accountchangeObject:
      title: ocsfv1.3.0accountchangeObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0accountchangeObservable:
      title: ocsfv1.3.0accountchangeObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0accountchangeObservable_TypeId:
      title: ocsfv1.3.0accountchangeObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0accountchangeOrganization:
      title: ocsfv1.3.0accountchangeOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0accountchangeOs:
      title: ocsfv1.3.0accountchangeOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0accountchangeOs_TypeId:
      title: ocsfv1.3.0accountchangeOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0accountchangeOsint:
      title: ocsfv1.3.0accountchangeOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0accountchangeOsint_ConfidenceId:
      title: ocsfv1.3.0accountchangeOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeOsint_Tlp:
      title: ocsfv1.3.0accountchangeOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0accountchangeOsint_TypeId:
      title: ocsfv1.3.0accountchangeOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0accountchangePackage:
      title: ocsfv1.3.0accountchangePackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangePackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0accountchangePackage_TypeId:
      title: ocsfv1.3.0accountchangePackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangePolicy:
      title: ocsfv1.3.0accountchangePolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0accountchangeProcess:
      title: ocsfv1.3.0accountchangeProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0accountchangeProcess_IntegrityId:
      title: ocsfv1.3.0accountchangeProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0accountchangeProduct:
      title: ocsfv1.3.0accountchangeProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0accountchangeRemediation:
      title: ocsfv1.3.0accountchangeRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0accountchangeReputation:
      title: ocsfv1.3.0accountchangeReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0accountchangeReputation_ScoreId:
      title: ocsfv1.3.0accountchangeReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0accountchangeRequest:
      title: ocsfv1.3.0accountchangeRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0accountchangeResponse:
      title: ocsfv1.3.0accountchangeResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0accountchangeService:
      title: ocsfv1.3.0accountchangeService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0accountchangeSession:
      title: ocsfv1.3.0accountchangeSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0accountchangeSubTechnique:
      title: ocsfv1.3.0accountchangeSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0accountchangeTactic:
      title: ocsfv1.3.0accountchangeTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0accountchangeTechnique:
      title: ocsfv1.3.0accountchangeTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0accountchangeTimespan:
      title: ocsfv1.3.0accountchangeTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0accountchangeTimespan_TypeId:
      title: ocsfv1.3.0accountchangeTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeUrl:
      title: ocsfv1.3.0accountchangeUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangePort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0accountchangeUrl_CategoryIds:
      title: ocsfv1.3.0accountchangeUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0accountchangeUser:
      title: ocsfv1.3.0accountchangeUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0accountchangeUser_MfaStatusId:
      title: ocsfv1.3.0accountchangeUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeUser_RiskLevelId:
      title: ocsfv1.3.0accountchangeUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0accountchangeUser_TypeId:
      title: ocsfv1.3.0accountchangeUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0accountchangeUser_UserStatusId:
      title: ocsfv1.3.0accountchangeUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0accountchangeVulnerability:
      title: ocsfv1.3.0accountchangeVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangePackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0accountchangeWhois:
      title: ocsfv1.3.0accountchangeWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0accountchangeDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0accountchangeSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0accountchangeWhois_DnssecStatusId:
      title: ocsfv1.3.0accountchangeWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityEmailAddress:
      title: ocsfv1.3.0apiactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0apiactivityFileName:
      title: ocsfv1.3.0apiactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0apiactivityHash:
      title: ocsfv1.3.0apiactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0apiactivityHostname:
      title: ocsfv1.3.0apiactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0apiactivityIPAddress:
      title: ocsfv1.3.0apiactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0apiactivityMACAddress:
      title: ocsfv1.3.0apiactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0apiactivityPort:
      title: ocsfv1.3.0apiactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0apiactivityProcessName:
      title: ocsfv1.3.0apiactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0apiactivitySubnet:
      title: ocsfv1.3.0apiactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0apiactivityTimestamp:
      title: ocsfv1.3.0apiactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0apiactivityURLString:
      title: ocsfv1.3.0apiactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0apiactivityUserName:
      title: ocsfv1.3.0apiactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0apiactivityActivityId:
      title: ocsfv1.3.0apiactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: The API call in the event pertains to a 'create' activity.

        2 - Read: The API call in the event pertains to a 'read' activity.

        3 - Update: The API call in the event pertains to a 'update' activity.

        4 - Delete: The API call in the event pertains to a 'delete' activity.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityApiActivity:
      title: ocsfv1.3.0apiactivityApiActivity
      type: object
      description: >-
        API events describe general CRUD (Create, Read, Update, Delete) API
        activities, e.g. (AWS Cloudtrail)
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityActor'
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Application Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: A list of custom fields
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkEndpoint'
          nullable: true
          description: The network destination endpoint.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHttpRequest'
          nullable: true
          description: Details about the underlying http request.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityResourceDetails'
          nullable: true
          description: Details about resources that were affected by the activity/event.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkEndpoint'
          description: Details about the source of the activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - actor
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - src_endpoint
        - time
        - type_uid
    ocsfv1.3.0apiactivityCategoryUid:
      title: ocsfv1.3.0apiactivityCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        6 - ApplicationActivity: Application Activity events report detailed
        information about the behavior of applications and services.
    ocsfv1.3.0apiactivityClassUid:
      title: ocsfv1.3.0apiactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        6003 - APIActivity: API events describe general CRUD (Create, Read,
        Update, Delete) API activities, e.g. (AWS Cloudtrail)
    ocsfv1.3.0apiactivitySeverityId:
      title: ocsfv1.3.0apiactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0apiactivityStatusId:
      title: ocsfv1.3.0apiactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0apiactivityTypeUid:
      title: ocsfv1.3.0apiactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        600300 - Unknown

        600301 - Create: The API call in the event pertains to a 'create'
        activity.

        600302 - Read: The API call in the event pertains to a 'read' activity.

        600303 - Update: The API call in the event pertains to a 'update'
        activity.

        600304 - Delete: The API call in the event pertains to a 'delete'
        activity.

        600399 - Other
    ocsfv1.3.0apiactivityAccount:
      title: ocsfv1.3.0apiactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0apiactivityAccount_TypeId:
      title: ocsfv1.3.0apiactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0apiactivityActor:
      title: ocsfv1.3.0apiactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0apiactivityActor_ActorTypeId:
      title: ocsfv1.3.0apiactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityAffectedCode:
      title: ocsfv1.3.0apiactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0apiactivityAffectedPackage:
      title: ocsfv1.3.0apiactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0apiactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0apiactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityAgent:
      title: ocsfv1.3.0apiactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0apiactivityAgent_TypeId:
      title: ocsfv1.3.0apiactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityApi:
      title: ocsfv1.3.0apiactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0apiactivityAttack:
      title: ocsfv1.3.0apiactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0apiactivityAuthorization:
      title: ocsfv1.3.0apiactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0apiactivityAutonomousSystem:
      title: ocsfv1.3.0apiactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0apiactivityCertificate:
      title: ocsfv1.3.0apiactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0apiactivityCloud:
      title: ocsfv1.3.0apiactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0apiactivityContainer:
      title: ocsfv1.3.0apiactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0apiactivityCve:
      title: ocsfv1.3.0apiactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0apiactivityCvss:
      title: ocsfv1.3.0apiactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0apiactivityCvss_Depth:
      title: ocsfv1.3.0apiactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0apiactivityCwe:
      title: ocsfv1.3.0apiactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0apiactivityDevice:
      title: ocsfv1.3.0apiactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0apiactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0apiactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0apiactivityDevice_RiskLevelId:
      title: ocsfv1.3.0apiactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0apiactivityDevice_TypeId:
      title: ocsfv1.3.0apiactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0apiactivityDeviceHwInfo:
      title: ocsfv1.3.0apiactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0apiactivityDigitalSignature:
      title: ocsfv1.3.0apiactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0apiactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0apiactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0apiactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0apiactivityDigitalSignature_StateId:
      title: ocsfv1.3.0apiactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0apiactivityDisplay:
      title: ocsfv1.3.0apiactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0apiactivityDnsAnswer:
      title: ocsfv1.3.0apiactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0apiactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0apiactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0apiactivityDomainContact:
      title: ocsfv1.3.0apiactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0apiactivityDomainContact_TypeId:
      title: ocsfv1.3.0apiactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityEmail:
      title: ocsfv1.3.0apiactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0apiactivityEmailAuth:
      title: ocsfv1.3.0apiactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0apiactivityEnrichment:
      title: ocsfv1.3.0apiactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0apiactivityEpss:
      title: ocsfv1.3.0apiactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0apiactivityExtension:
      title: ocsfv1.3.0apiactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0apiactivityFeature:
      title: ocsfv1.3.0apiactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0apiactivityFile:
      title: ocsfv1.3.0apiactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0apiactivityFile_ConfidentialityId:
      title: ocsfv1.3.0apiactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityFile_TypeId:
      title: ocsfv1.3.0apiactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityFingerprint:
      title: ocsfv1.3.0apiactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0apiactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0apiactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0apiactivityGroup:
      title: ocsfv1.3.0apiactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0apiactivityHttpHeader:
      title: ocsfv1.3.0apiactivityHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0apiactivityHttpRequest:
      title: ocsfv1.3.0apiactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0apiactivityHttpRequest_HttpMethod:
      title: ocsfv1.3.0apiactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0apiactivityIdp:
      title: ocsfv1.3.0apiactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0apiactivityImage:
      title: ocsfv1.3.0apiactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0apiactivityKbArticle:
      title: ocsfv1.3.0apiactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0apiactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0apiactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityKeyboardInfo:
      title: ocsfv1.3.0apiactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0apiactivityKillChainPhase:
      title: ocsfv1.3.0apiactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0apiactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0apiactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0apiactivityLdapPerson:
      title: ocsfv1.3.0apiactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0apiactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0apiactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0apiactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityLocation:
      title: ocsfv1.3.0apiactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0apiactivityLogger:
      title: ocsfv1.3.0apiactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0apiactivityMetadata:
      title: ocsfv1.3.0apiactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0apiactivityMetric:
      title: ocsfv1.3.0apiactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0apiactivityNetworkEndpoint:
      title: ocsfv1.3.0apiactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0apiactivityNetworkEndpoint_TypeId:
      title: ocsfv1.3.0apiactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0apiactivityNetworkInterface:
      title: ocsfv1.3.0apiactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0apiactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0apiactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityNetworkProxy:
      title: ocsfv1.3.0apiactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0apiactivityNetworkProxy_TypeId:
      title: ocsfv1.3.0apiactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0apiactivityObject:
      title: ocsfv1.3.0apiactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0apiactivityObservable:
      title: ocsfv1.3.0apiactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0apiactivityObservable_TypeId:
      title: ocsfv1.3.0apiactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0apiactivityOrganization:
      title: ocsfv1.3.0apiactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0apiactivityOs:
      title: ocsfv1.3.0apiactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0apiactivityOs_TypeId:
      title: ocsfv1.3.0apiactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0apiactivityOsint:
      title: ocsfv1.3.0apiactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0apiactivityOsint_ConfidenceId:
      title: ocsfv1.3.0apiactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityOsint_Tlp:
      title: ocsfv1.3.0apiactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0apiactivityOsint_TypeId:
      title: ocsfv1.3.0apiactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0apiactivityPackage:
      title: ocsfv1.3.0apiactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0apiactivityPackage_TypeId:
      title: ocsfv1.3.0apiactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityPolicy:
      title: ocsfv1.3.0apiactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0apiactivityProcess:
      title: ocsfv1.3.0apiactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0apiactivityProcess_IntegrityId:
      title: ocsfv1.3.0apiactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0apiactivityProduct:
      title: ocsfv1.3.0apiactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0apiactivityRemediation:
      title: ocsfv1.3.0apiactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0apiactivityReputation:
      title: ocsfv1.3.0apiactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0apiactivityReputation_ScoreId:
      title: ocsfv1.3.0apiactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0apiactivityRequest:
      title: ocsfv1.3.0apiactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0apiactivityResourceDetails:
      title: ocsfv1.3.0apiactivityResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0apiactivityResponse:
      title: ocsfv1.3.0apiactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0apiactivityService:
      title: ocsfv1.3.0apiactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0apiactivitySession:
      title: ocsfv1.3.0apiactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0apiactivitySubTechnique:
      title: ocsfv1.3.0apiactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0apiactivityTactic:
      title: ocsfv1.3.0apiactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0apiactivityTechnique:
      title: ocsfv1.3.0apiactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0apiactivityTimespan:
      title: ocsfv1.3.0apiactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0apiactivityTimespan_TypeId:
      title: ocsfv1.3.0apiactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityUrl:
      title: ocsfv1.3.0apiactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0apiactivityUrl_CategoryIds:
      title: ocsfv1.3.0apiactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0apiactivityUser:
      title: ocsfv1.3.0apiactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0apiactivityUser_MfaStatusId:
      title: ocsfv1.3.0apiactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityUser_RiskLevelId:
      title: ocsfv1.3.0apiactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0apiactivityUser_TypeId:
      title: ocsfv1.3.0apiactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0apiactivityUser_UserStatusId:
      title: ocsfv1.3.0apiactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0apiactivityVulnerability:
      title: ocsfv1.3.0apiactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0apiactivityWhois:
      title: ocsfv1.3.0apiactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0apiactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0apiactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0apiactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0apiactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleEmailAddress:
      title: ocsfv1.3.0applicationlifecycleEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0applicationlifecycleFileName:
      title: ocsfv1.3.0applicationlifecycleFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0applicationlifecycleHash:
      title: ocsfv1.3.0applicationlifecycleHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0applicationlifecycleHostname:
      title: ocsfv1.3.0applicationlifecycleHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0applicationlifecycleIPAddress:
      title: ocsfv1.3.0applicationlifecycleIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0applicationlifecycleMACAddress:
      title: ocsfv1.3.0applicationlifecycleMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0applicationlifecyclePort:
      title: ocsfv1.3.0applicationlifecyclePort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0applicationlifecycleProcessName:
      title: ocsfv1.3.0applicationlifecycleProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0applicationlifecycleSubnet:
      title: ocsfv1.3.0applicationlifecycleSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0applicationlifecycleTimestamp:
      title: ocsfv1.3.0applicationlifecycleTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0applicationlifecycleURLString:
      title: ocsfv1.3.0applicationlifecycleURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0applicationlifecycleUserName:
      title: ocsfv1.3.0applicationlifecycleUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0applicationlifecycleActivityId:
      title: ocsfv1.3.0applicationlifecycleActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Install: Install the application.

        2 - Remove: Remove the application.

        3 - Start: Start the application.

        4 - Stop: Stop the application.

        5 - Restart: Restart the application.

        6 - Enable: Enable the application.

        7 - Disable: Disable the application.

        8 - Update: Update the application.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleApplicationLifecycle:
      title: ocsfv1.3.0applicationlifecycleApplicationLifecycle
      type: object
      description: >-
        Application Lifecycle events report installation, removal, start, stop
        of an application or service.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        app:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          description: >-
            The application that was affected by the lifecycle event. This also
            applies to self-updating application systems.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Application Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - app
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0applicationlifecycleCategoryUid:
      title: ocsfv1.3.0applicationlifecycleCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        6 - ApplicationActivity: Application Activity events report detailed
        information about the behavior of applications and services.
    ocsfv1.3.0applicationlifecycleClassUid:
      title: ocsfv1.3.0applicationlifecycleClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        6002 - ApplicationLifecycle: Application Lifecycle events report
        installation, removal, start, stop of an application or service.
    ocsfv1.3.0applicationlifecycleSeverityId:
      title: ocsfv1.3.0applicationlifecycleSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0applicationlifecycleStatusId:
      title: ocsfv1.3.0applicationlifecycleStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleTypeUid:
      title: ocsfv1.3.0applicationlifecycleTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        600200 - Unknown
        600201 - Install: Install the application.
        600202 - Remove: Remove the application.
        600203 - Start: Start the application.
        600204 - Stop: Stop the application.
        600205 - Restart: Restart the application.
        600206 - Enable: Enable the application.
        600207 - Disable: Disable the application.
        600208 - Update: Update the application.
        600299 - Other
    ocsfv1.3.0applicationlifecycleAccount:
      title: ocsfv1.3.0applicationlifecycleAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0applicationlifecycleAccount_TypeId:
      title: ocsfv1.3.0applicationlifecycleAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0applicationlifecycleActor:
      title: ocsfv1.3.0applicationlifecycleActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0applicationlifecycleActor_ActorTypeId:
      title: ocsfv1.3.0applicationlifecycleActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleAffectedCode:
      title: ocsfv1.3.0applicationlifecycleAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0applicationlifecycleAffectedPackage:
      title: ocsfv1.3.0applicationlifecycleAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0applicationlifecycleAffectedPackage_TypeId:
      title: ocsfv1.3.0applicationlifecycleAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleAgent:
      title: ocsfv1.3.0applicationlifecycleAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0applicationlifecycleAgent_TypeId:
      title: ocsfv1.3.0applicationlifecycleAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleApi:
      title: ocsfv1.3.0applicationlifecycleApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0applicationlifecycleAttack:
      title: ocsfv1.3.0applicationlifecycleAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0applicationlifecycleAuthorization:
      title: ocsfv1.3.0applicationlifecycleAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecyclePolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0applicationlifecycleAutonomousSystem:
      title: ocsfv1.3.0applicationlifecycleAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0applicationlifecycleCertificate:
      title: ocsfv1.3.0applicationlifecycleCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0applicationlifecycleCloud:
      title: ocsfv1.3.0applicationlifecycleCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0applicationlifecycleContainer:
      title: ocsfv1.3.0applicationlifecycleContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0applicationlifecycleCve:
      title: ocsfv1.3.0applicationlifecycleCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0applicationlifecycleCvss:
      title: ocsfv1.3.0applicationlifecycleCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0applicationlifecycleCvss_Depth:
      title: ocsfv1.3.0applicationlifecycleCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0applicationlifecycleCwe:
      title: ocsfv1.3.0applicationlifecycleCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0applicationlifecycleDevice:
      title: ocsfv1.3.0applicationlifecycleDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0applicationlifecycleNetworkInterface
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0applicationlifecycleDevice_NetworkStatusId:
      title: ocsfv1.3.0applicationlifecycleDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0applicationlifecycleDevice_RiskLevelId:
      title: ocsfv1.3.0applicationlifecycleDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0applicationlifecycleDevice_TypeId:
      title: ocsfv1.3.0applicationlifecycleDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0applicationlifecycleDeviceHwInfo:
      title: ocsfv1.3.0applicationlifecycleDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0applicationlifecycleDigitalSignature:
      title: ocsfv1.3.0applicationlifecycleDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0applicationlifecycleDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0applicationlifecycleDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleDigitalSignature_StateId:
      title: ocsfv1.3.0applicationlifecycleDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleDisplay:
      title: ocsfv1.3.0applicationlifecycleDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0applicationlifecycleDnsAnswer:
      title: ocsfv1.3.0applicationlifecycleDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0applicationlifecycleDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0applicationlifecycleDnsAnswer_FlagIds:
      title: ocsfv1.3.0applicationlifecycleDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleDomainContact:
      title: ocsfv1.3.0applicationlifecycleDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0applicationlifecycleDomainContact_TypeId:
      title: ocsfv1.3.0applicationlifecycleDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleEmail:
      title: ocsfv1.3.0applicationlifecycleEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0applicationlifecycleEmailAuth:
      title: ocsfv1.3.0applicationlifecycleEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0applicationlifecycleEnrichment:
      title: ocsfv1.3.0applicationlifecycleEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0applicationlifecycleEpss:
      title: ocsfv1.3.0applicationlifecycleEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0applicationlifecycleExtension:
      title: ocsfv1.3.0applicationlifecycleExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0applicationlifecycleFeature:
      title: ocsfv1.3.0applicationlifecycleFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0applicationlifecycleFile:
      title: ocsfv1.3.0applicationlifecycleFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0applicationlifecycleFile_ConfidentialityId:
      title: ocsfv1.3.0applicationlifecycleFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleFile_TypeId:
      title: ocsfv1.3.0applicationlifecycleFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleFingerprint:
      title: ocsfv1.3.0applicationlifecycleFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0applicationlifecycleFingerprint_AlgorithmId:
      title: ocsfv1.3.0applicationlifecycleFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleGroup:
      title: ocsfv1.3.0applicationlifecycleGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0applicationlifecycleIdp:
      title: ocsfv1.3.0applicationlifecycleIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0applicationlifecycleImage:
      title: ocsfv1.3.0applicationlifecycleImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0applicationlifecycleKbArticle:
      title: ocsfv1.3.0applicationlifecycleKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0applicationlifecycleKbArticle_InstallStateId:
      title: ocsfv1.3.0applicationlifecycleKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleKeyboardInfo:
      title: ocsfv1.3.0applicationlifecycleKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0applicationlifecycleKillChainPhase:
      title: ocsfv1.3.0applicationlifecycleKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0applicationlifecycleKillChainPhase_PhaseId:
      title: ocsfv1.3.0applicationlifecycleKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0applicationlifecycleLdapPerson:
      title: ocsfv1.3.0applicationlifecycleLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0applicationlifecycleLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0applicationlifecycleLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleLocation:
      title: ocsfv1.3.0applicationlifecycleLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0applicationlifecycleLogger:
      title: ocsfv1.3.0applicationlifecycleLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0applicationlifecycleMetadata:
      title: ocsfv1.3.0applicationlifecycleMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0applicationlifecycleMetric:
      title: ocsfv1.3.0applicationlifecycleMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0applicationlifecycleNetworkInterface:
      title: ocsfv1.3.0applicationlifecycleNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0applicationlifecycleNetworkInterface_TypeId:
      title: ocsfv1.3.0applicationlifecycleNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleObject:
      title: ocsfv1.3.0applicationlifecycleObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0applicationlifecycleObservable:
      title: ocsfv1.3.0applicationlifecycleObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0applicationlifecycleObservable_TypeId:
      title: ocsfv1.3.0applicationlifecycleObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0applicationlifecycleOrganization:
      title: ocsfv1.3.0applicationlifecycleOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0applicationlifecycleOs:
      title: ocsfv1.3.0applicationlifecycleOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0applicationlifecycleOs_TypeId:
      title: ocsfv1.3.0applicationlifecycleOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0applicationlifecycleOsint:
      title: ocsfv1.3.0applicationlifecycleOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0applicationlifecycleDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0applicationlifecycleOsint_ConfidenceId:
      title: ocsfv1.3.0applicationlifecycleOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleOsint_Tlp:
      title: ocsfv1.3.0applicationlifecycleOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0applicationlifecycleOsint_TypeId:
      title: ocsfv1.3.0applicationlifecycleOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0applicationlifecyclePackage:
      title: ocsfv1.3.0applicationlifecyclePackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecyclePackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0applicationlifecyclePackage_TypeId:
      title: ocsfv1.3.0applicationlifecyclePackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecyclePolicy:
      title: ocsfv1.3.0applicationlifecyclePolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0applicationlifecycleProcess:
      title: ocsfv1.3.0applicationlifecycleProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0applicationlifecycleProcess_IntegrityId:
      title: ocsfv1.3.0applicationlifecycleProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0applicationlifecycleProduct:
      title: ocsfv1.3.0applicationlifecycleProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0applicationlifecycleRemediation:
      title: ocsfv1.3.0applicationlifecycleRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0applicationlifecycleReputation:
      title: ocsfv1.3.0applicationlifecycleReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0applicationlifecycleReputation_ScoreId:
      title: ocsfv1.3.0applicationlifecycleReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0applicationlifecycleRequest:
      title: ocsfv1.3.0applicationlifecycleRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0applicationlifecycleResponse:
      title: ocsfv1.3.0applicationlifecycleResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0applicationlifecycleService:
      title: ocsfv1.3.0applicationlifecycleService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0applicationlifecycleSession:
      title: ocsfv1.3.0applicationlifecycleSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0applicationlifecycleSubTechnique:
      title: ocsfv1.3.0applicationlifecycleSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0applicationlifecycleTactic:
      title: ocsfv1.3.0applicationlifecycleTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0applicationlifecycleTechnique:
      title: ocsfv1.3.0applicationlifecycleTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0applicationlifecycleTimespan:
      title: ocsfv1.3.0applicationlifecycleTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0applicationlifecycleTimespan_TypeId:
      title: ocsfv1.3.0applicationlifecycleTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleUrl:
      title: ocsfv1.3.0applicationlifecycleUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecyclePort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0applicationlifecycleUrl_CategoryIds:
      title: ocsfv1.3.0applicationlifecycleUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0applicationlifecycleUser:
      title: ocsfv1.3.0applicationlifecycleUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0applicationlifecycleUser_MfaStatusId:
      title: ocsfv1.3.0applicationlifecycleUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleUser_RiskLevelId:
      title: ocsfv1.3.0applicationlifecycleUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0applicationlifecycleUser_TypeId:
      title: ocsfv1.3.0applicationlifecycleUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0applicationlifecycleUser_UserStatusId:
      title: ocsfv1.3.0applicationlifecycleUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0applicationlifecycleVulnerability:
      title: ocsfv1.3.0applicationlifecycleVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecyclePackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0applicationlifecycleWhois:
      title: ocsfv1.3.0applicationlifecycleWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0applicationlifecycleWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0applicationlifecycleSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0applicationlifecycleWhois_DnssecStatusId:
      title: ocsfv1.3.0applicationlifecycleWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationEmailAddress:
      title: ocsfv1.3.0authenticationEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0authenticationFileName:
      title: ocsfv1.3.0authenticationFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0authenticationHash:
      title: ocsfv1.3.0authenticationHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0authenticationHostname:
      title: ocsfv1.3.0authenticationHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0authenticationIPAddress:
      title: ocsfv1.3.0authenticationIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0authenticationMACAddress:
      title: ocsfv1.3.0authenticationMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0authenticationPort:
      title: ocsfv1.3.0authenticationPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0authenticationProcessName:
      title: ocsfv1.3.0authenticationProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0authenticationSubnet:
      title: ocsfv1.3.0authenticationSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0authenticationTimestamp:
      title: ocsfv1.3.0authenticationTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0authenticationURLString:
      title: ocsfv1.3.0authenticationURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0authenticationUserName:
      title: ocsfv1.3.0authenticationUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0authenticationActivityId:
      title: ocsfv1.3.0authenticationActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Logon: A new logon session was requested.

        2 - Logoff: A logon session was terminated and no longer exists.

        3 - AuthenticationTicket: A Kerberos authentication ticket (TGT) was
        requested.

        4 - ServiceTicketRequest: A Kerberos service ticket was requested.

        5 - ServiceTicketRenew: A Kerberos service ticket was renewed.

        6 - Preauth: A preauthentication stage was engaged.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationAuthProtocolId:
      title: ocsfv1.3.0authenticationAuthProtocolId
      type: integer
      description: >-
        AuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationAuthentication:
      title: ocsfv1.3.0authenticationAuthentication
      type: object
      description: >-
        Authentication events report authentication session activities such as
        user attempts a logon or logoff, successfully or otherwise.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationActor'
          nullable: true
          description: The actor that requested the authentication.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        auth_factors:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAuthFactor'
          nullable: true
          description: >-
            Describes a category of methods used for identity verification in an
            authentication attempt.
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authentication protocol as defined by the caption of
            'auth_protocol_id'. In the case of 'Other', it is defined by the
            event source.
        auth_protocol_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAuthProtocolId'
          nullable: true
          description: >-
            The normalized identifier of the authentication protocol used to
            create the user session.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Identity &amp; Access Management</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCategoryUid'
          description: The category unique identifier of the event.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCertificate'
          nullable: true
          description: >-
            The certificate associated with the authentication or
            pre-authentication (Kerberos).
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDevice'
          nullable: true
          description: An addressable device, computer system or host.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkEndpoint'
          nullable: true
          description: The endpoint to which the authentication was targeted.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        is_cleartext:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the credentials were passed in clear
            text.<p><b>Note:</b> True if the credentials were passed in a clear
            text protocol such as FTP or TELNET, or if Windows detected that a
            user's logon password was passed to the authentication package in
            clear text.</p>
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_new_logon:
          type: boolean
          nullable: true
          description: >-
            Indicates logon is from a device not seen before or a first time
            account logon.
        is_remote:
          type: boolean
          nullable: true
          description: The attempted authentication is over a remote connection.
        logon_process:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProcess'
          nullable: true
          description: The trusted process that validated the authentication credentials.
        logon_type:
          type: string
          nullable: true
          description: >-
            The logon type, normalized to the caption of the logon_type_id
            value. In the case of 'Other', it is defined by the event source.
        logon_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLogonTypeId'
          nullable: true
          description: The normalized logon type identifier.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationService'
          nullable: true
          description: >-
            The service or gateway to which the user or process is being
            authenticated
        session:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSession'
          nullable: true
          description: The authenticated user or service session.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkEndpoint'
          nullable: true
          description: Details about the source of the IAM activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The details about the authentication request. For example, possible
            details for Windows logon or logoff events
            are:<ul><li>Success</li><ul><li>LOGOFF_USER_INITIATED</li><li>LOGOFF_OTHER</li></ul><li>Failure</li><ul><li>USER_DOES_NOT_EXIST</li><li>INVALID_CREDENTIALS</li><li>ACCOUNT_DISABLED</li><li>ACCOUNT_LOCKED_OUT</li><li>PASSWORD_EXPIRED</li></ul></ul>
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          description: The subject (user/role or account) to authenticate.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
        - user
    ocsfv1.3.0authenticationCategoryUid:
      title: ocsfv1.3.0authenticationCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        3 - AccessManagement: Identity &amp; Access Management (IAM) events
        relate to the supervision of the system's authentication and access
        control model. Examples of such events are the success or failure of
        authentication, granting of authority, password change, entity change,
        privileged use etc.
    ocsfv1.3.0authenticationClassUid:
      title: ocsfv1.3.0authenticationClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        3002 - Authentication: Authentication events report authentication
        session activities such as user attempts a logon or logoff, successfully
        or otherwise.
    ocsfv1.3.0authenticationLogonTypeId:
      title: ocsfv1.3.0authenticationLogonTypeId
      type: integer
      description: >-
        LogonTypeId is an enum, and the following values are allowed.

        0 - Unknown: The logon type is unknown.

        1 - System: Used only by the System account, for example at system
        startup.

        2 - Interactive: A local logon to device console.

        3 - Network: A user or device logged onto this device from the network.

        4 - Batch: A batch server logon, where processes may be executing on
        behalf of a user without their direct intervention.

        5 - OSService: A logon by a service or daemon that was started by the
        OS.

        7 - Unlock: A user unlocked the device.

        8 - NetworkCleartext: A user logged on to this device from the network.
        The user's password in the authentication package was not hashed.

        9 - NewCredentials: A caller cloned its current token and specified new
        credentials for outbound connections. The new logon session has the same
        local identity, but uses different credentials for other network
        connections.

        10 - RemoteInteractive: A remote logon using Terminal Services or remote
        desktop application.

        11 - CachedInteractive: A user logged on to this device with network
        credentials that were stored locally on the device and the domain
        controller was not contacted to verify the credentials.

        12 - CachedRemoteInteractive: Same as Remote Interactive. This is used
        for internal auditing.

        13 - CachedUnlock: Workstation logon.

        99 - Other: The logon type is not mapped. See the
        <code>logon_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationSeverityId:
      title: ocsfv1.3.0authenticationSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationStatusId:
      title: ocsfv1.3.0authenticationStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authenticationTypeUid:
      title: ocsfv1.3.0authenticationTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        300200 - Unknown

        300201 - Logon: A new logon session was requested.

        300202 - Logoff: A logon session was terminated and no longer exists.

        300203 - AuthenticationTicket: A Kerberos authentication ticket (TGT)
        was requested.

        300204 - ServiceTicketRequest: A Kerberos service ticket was requested.

        300205 - ServiceTicketRenew: A Kerberos service ticket was renewed.

        300206 - Preauth: A preauthentication stage was engaged.

        300299 - Other
    ocsfv1.3.0authenticationAccount:
      title: ocsfv1.3.0authenticationAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0authenticationAccount_TypeId:
      title: ocsfv1.3.0authenticationAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0authenticationActor:
      title: ocsfv1.3.0authenticationActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0authenticationActor_ActorTypeId:
      title: ocsfv1.3.0authenticationActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationAffectedCode:
      title: ocsfv1.3.0authenticationAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0authenticationAffectedPackage:
      title: ocsfv1.3.0authenticationAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0authenticationAffectedPackage_TypeId:
      title: ocsfv1.3.0authenticationAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationAgent:
      title: ocsfv1.3.0authenticationAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0authenticationAgent_TypeId:
      title: ocsfv1.3.0authenticationAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationApi:
      title: ocsfv1.3.0authenticationApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0authenticationAttack:
      title: ocsfv1.3.0authenticationAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0authenticationAuthFactor:
      title: ocsfv1.3.0authenticationAuthFactor
      type: object
      description: >-
        An Authentication Factor object describes a category of methods used for
        identity verification in an authentication attempt.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDevice'
          nullable: true
          description: Device used to complete an authentication request.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The email address used in an email-based authentication factor.
        factor_type:
          type: string
          nullable: true
          description: The type of authentication factor used in an authentication attempt.
        factor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAuthFactor_FactorTypeId'
          description: The normalized identifier for the authentication factor.
        is_hotp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is an HMAC-based One-time Password
            (HOTP).
        is_totp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is a Time-based One-time Password
            (TOTP).
        phone_number:
          type: string
          nullable: true
          description: The phone number used for a telephony-based authentication request.
        provider:
          type: string
          nullable: true
          description: The name of provider for an authentication factor.
        security_questions:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The question(s) provided to user for a question-based authentication
            factor.
      required:
        - factor_type_id
    ocsfv1.3.0authenticationAuthFactor_FactorTypeId:
      title: ocsfv1.3.0authenticationAuthFactor_FactorTypeId
      type: integer
      description: >-
        AuthFactorFactorTypeId is an enum, and the following values are allowed.

        0 - Unknown

        1 - SMS: User receives and inputs a code sent to their mobile device via
        SMS text message.

        2 - SecurityQuestion: The user responds to a security question as part
        of a question-based authentication factor

        3 - PhoneCall: System calls the user's registered phone number and
        requires the user to answer and provide a response.

        4 - Biometric: Devices that verify identity-based on user's physical
        identifiers, such as fingerprint scanners or retina scanners.

        5 - PushNotification: Push notification is sent to user's registered
        device and requires the user to acknowledge.

        6 - HardwareToken: Physical device that generates a code to be used for
        authentication.

        7 - OTP: Application generates a one-time password (OTP) for use in
        authentication.

        8 - Email: A code or link is sent to a user's registered email address.

        9 - U2F: Typically involves a hardware token, which the user physically
        interacts with to authenticate.

        10 - WebAuthn: Web-based API that enables users to register devices as
        authentication factors.

        11 - Password: The user enters a password that they have previously
        established.

        99 - Other
    ocsfv1.3.0authenticationAuthorization:
      title: ocsfv1.3.0authenticationAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0authenticationAutonomousSystem:
      title: ocsfv1.3.0authenticationAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0authenticationCertificate:
      title: ocsfv1.3.0authenticationCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0authenticationCloud:
      title: ocsfv1.3.0authenticationCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0authenticationContainer:
      title: ocsfv1.3.0authenticationContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0authenticationCve:
      title: ocsfv1.3.0authenticationCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0authenticationCvss:
      title: ocsfv1.3.0authenticationCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0authenticationCvss_Depth:
      title: ocsfv1.3.0authenticationCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0authenticationCwe:
      title: ocsfv1.3.0authenticationCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0authenticationDevice:
      title: ocsfv1.3.0authenticationDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0authenticationDevice_NetworkStatusId:
      title: ocsfv1.3.0authenticationDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0authenticationDevice_RiskLevelId:
      title: ocsfv1.3.0authenticationDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationDevice_TypeId:
      title: ocsfv1.3.0authenticationDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0authenticationDeviceHwInfo:
      title: ocsfv1.3.0authenticationDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0authenticationDigitalSignature:
      title: ocsfv1.3.0authenticationDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authenticationDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authenticationDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0authenticationDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0authenticationDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authenticationDigitalSignature_StateId:
      title: ocsfv1.3.0authenticationDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authenticationDisplay:
      title: ocsfv1.3.0authenticationDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0authenticationDnsAnswer:
      title: ocsfv1.3.0authenticationDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0authenticationDnsAnswer_FlagIds:
      title: ocsfv1.3.0authenticationDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authenticationDomainContact:
      title: ocsfv1.3.0authenticationDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0authenticationDomainContact_TypeId:
      title: ocsfv1.3.0authenticationDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationEmail:
      title: ocsfv1.3.0authenticationEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0authenticationEmailAuth:
      title: ocsfv1.3.0authenticationEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0authenticationEnrichment:
      title: ocsfv1.3.0authenticationEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0authenticationEpss:
      title: ocsfv1.3.0authenticationEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0authenticationExtension:
      title: ocsfv1.3.0authenticationExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0authenticationFeature:
      title: ocsfv1.3.0authenticationFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0authenticationFile:
      title: ocsfv1.3.0authenticationFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0authenticationFile_ConfidentialityId:
      title: ocsfv1.3.0authenticationFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationFile_TypeId:
      title: ocsfv1.3.0authenticationFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationFingerprint:
      title: ocsfv1.3.0authenticationFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0authenticationFingerprint_AlgorithmId:
      title: ocsfv1.3.0authenticationFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authenticationGroup:
      title: ocsfv1.3.0authenticationGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0authenticationHttpHeader:
      title: ocsfv1.3.0authenticationHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0authenticationHttpRequest:
      title: ocsfv1.3.0authenticationHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0authenticationHttpRequest_HttpMethod:
      title: ocsfv1.3.0authenticationHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0authenticationIdp:
      title: ocsfv1.3.0authenticationIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0authenticationImage:
      title: ocsfv1.3.0authenticationImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0authenticationKbArticle:
      title: ocsfv1.3.0authenticationKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authenticationKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0authenticationKbArticle_InstallStateId:
      title: ocsfv1.3.0authenticationKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationKeyboardInfo:
      title: ocsfv1.3.0authenticationKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0authenticationKillChainPhase:
      title: ocsfv1.3.0authenticationKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0authenticationKillChainPhase_PhaseId:
      title: ocsfv1.3.0authenticationKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationLdapPerson:
      title: ocsfv1.3.0authenticationLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authenticationLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0authenticationLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0authenticationLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationLocation:
      title: ocsfv1.3.0authenticationLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0authenticationLogger:
      title: ocsfv1.3.0authenticationLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0authenticationMetadata:
      title: ocsfv1.3.0authenticationMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0authenticationMetric:
      title: ocsfv1.3.0authenticationMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0authenticationNetworkEndpoint:
      title: ocsfv1.3.0authenticationNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0authenticationNetworkEndpoint_TypeId:
      title: ocsfv1.3.0authenticationNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0authenticationNetworkInterface:
      title: ocsfv1.3.0authenticationNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0authenticationNetworkInterface_TypeId:
      title: ocsfv1.3.0authenticationNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationNetworkProxy:
      title: ocsfv1.3.0authenticationNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0authenticationNetworkProxy_TypeId:
      title: ocsfv1.3.0authenticationNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0authenticationObject:
      title: ocsfv1.3.0authenticationObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0authenticationObservable:
      title: ocsfv1.3.0authenticationObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0authenticationObservable_TypeId:
      title: ocsfv1.3.0authenticationObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0authenticationOrganization:
      title: ocsfv1.3.0authenticationOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0authenticationOs:
      title: ocsfv1.3.0authenticationOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0authenticationOs_TypeId:
      title: ocsfv1.3.0authenticationOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0authenticationOsint:
      title: ocsfv1.3.0authenticationOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0authenticationOsint_ConfidenceId:
      title: ocsfv1.3.0authenticationOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationOsint_Tlp:
      title: ocsfv1.3.0authenticationOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0authenticationOsint_TypeId:
      title: ocsfv1.3.0authenticationOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0authenticationPackage:
      title: ocsfv1.3.0authenticationPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0authenticationPackage_TypeId:
      title: ocsfv1.3.0authenticationPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationPolicy:
      title: ocsfv1.3.0authenticationPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0authenticationProcess:
      title: ocsfv1.3.0authenticationProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0authenticationProcess_IntegrityId:
      title: ocsfv1.3.0authenticationProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationProduct:
      title: ocsfv1.3.0authenticationProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0authenticationRemediation:
      title: ocsfv1.3.0authenticationRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0authenticationReputation:
      title: ocsfv1.3.0authenticationReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0authenticationReputation_ScoreId:
      title: ocsfv1.3.0authenticationReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationRequest:
      title: ocsfv1.3.0authenticationRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0authenticationResponse:
      title: ocsfv1.3.0authenticationResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0authenticationService:
      title: ocsfv1.3.0authenticationService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0authenticationSession:
      title: ocsfv1.3.0authenticationSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0authenticationSubTechnique:
      title: ocsfv1.3.0authenticationSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0authenticationTactic:
      title: ocsfv1.3.0authenticationTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0authenticationTechnique:
      title: ocsfv1.3.0authenticationTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0authenticationTimespan:
      title: ocsfv1.3.0authenticationTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0authenticationTimespan_TypeId:
      title: ocsfv1.3.0authenticationTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationUrl:
      title: ocsfv1.3.0authenticationUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0authenticationUrl_CategoryIds:
      title: ocsfv1.3.0authenticationUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0authenticationUser:
      title: ocsfv1.3.0authenticationUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0authenticationUser_MfaStatusId:
      title: ocsfv1.3.0authenticationUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationUser_RiskLevelId:
      title: ocsfv1.3.0authenticationUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authenticationUser_TypeId:
      title: ocsfv1.3.0authenticationUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authenticationUser_UserStatusId:
      title: ocsfv1.3.0authenticationUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authenticationVulnerability:
      title: ocsfv1.3.0authenticationVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0authenticationWhois:
      title: ocsfv1.3.0authenticationWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authenticationDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0authenticationSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0authenticationWhois_DnssecStatusId:
      title: ocsfv1.3.0authenticationWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionEmailAddress:
      title: ocsfv1.3.0authorizesessionEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0authorizesessionFileName:
      title: ocsfv1.3.0authorizesessionFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0authorizesessionHash:
      title: ocsfv1.3.0authorizesessionHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0authorizesessionHostname:
      title: ocsfv1.3.0authorizesessionHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0authorizesessionIPAddress:
      title: ocsfv1.3.0authorizesessionIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0authorizesessionMACAddress:
      title: ocsfv1.3.0authorizesessionMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0authorizesessionPort:
      title: ocsfv1.3.0authorizesessionPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0authorizesessionProcessName:
      title: ocsfv1.3.0authorizesessionProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0authorizesessionSubnet:
      title: ocsfv1.3.0authorizesessionSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0authorizesessionTimestamp:
      title: ocsfv1.3.0authorizesessionTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0authorizesessionURLString:
      title: ocsfv1.3.0authorizesessionURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0authorizesessionUserName:
      title: ocsfv1.3.0authorizesessionUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0authorizesessionActivityId:
      title: ocsfv1.3.0authorizesessionActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - AssignPrivileges: Assign special privileges to a new logon.

        2 - AssignGroups: Assign special groups to a new logon.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionAuthorizeSession:
      title: ocsfv1.3.0authorizesessionAuthorizeSession
      type: object
      description: >-
        Authorize Session events report privileges or groups assigned to a new
        user session, usually at login time.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Identity &amp; Access Management</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDevice'
          nullable: true
          description: An addressable device, computer system or host.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionNetworkEndpoint'
          nullable: true
          description: The Endpoint for which the user session was targeted.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: Group that was assigned to the new user session.
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The list of sensitive privileges, assigned to the new user session.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSession'
          nullable: true
          description: The user session with the assigned privileges.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionNetworkEndpoint'
          nullable: true
          description: Details about the source of the IAM activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          description: The user to which new privileges were assigned.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
        - user
    ocsfv1.3.0authorizesessionCategoryUid:
      title: ocsfv1.3.0authorizesessionCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        3 - AccessManagement: Identity &amp; Access Management (IAM) events
        relate to the supervision of the system's authentication and access
        control model. Examples of such events are the success or failure of
        authentication, granting of authority, password change, entity change,
        privileged use etc.
    ocsfv1.3.0authorizesessionClassUid:
      title: ocsfv1.3.0authorizesessionClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        3003 - AuthorizeSession: Authorize Session events report privileges or
        groups assigned to a new user session, usually at login time.
    ocsfv1.3.0authorizesessionSeverityId:
      title: ocsfv1.3.0authorizesessionSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authorizesessionStatusId:
      title: ocsfv1.3.0authorizesessionStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authorizesessionTypeUid:
      title: ocsfv1.3.0authorizesessionTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        300300 - Unknown
        300301 - AssignPrivileges: Assign special privileges to a new logon.
        300302 - AssignGroups: Assign special groups to a new logon.
        300399 - Other
    ocsfv1.3.0authorizesessionAccount:
      title: ocsfv1.3.0authorizesessionAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0authorizesessionAccount_TypeId:
      title: ocsfv1.3.0authorizesessionAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0authorizesessionActor:
      title: ocsfv1.3.0authorizesessionActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0authorizesessionActor_ActorTypeId:
      title: ocsfv1.3.0authorizesessionActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionAffectedCode:
      title: ocsfv1.3.0authorizesessionAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0authorizesessionAffectedPackage:
      title: ocsfv1.3.0authorizesessionAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0authorizesessionAffectedPackage_TypeId:
      title: ocsfv1.3.0authorizesessionAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionAgent:
      title: ocsfv1.3.0authorizesessionAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0authorizesessionAgent_TypeId:
      title: ocsfv1.3.0authorizesessionAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionApi:
      title: ocsfv1.3.0authorizesessionApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0authorizesessionAttack:
      title: ocsfv1.3.0authorizesessionAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0authorizesessionAuthorization:
      title: ocsfv1.3.0authorizesessionAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0authorizesessionAutonomousSystem:
      title: ocsfv1.3.0authorizesessionAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0authorizesessionCertificate:
      title: ocsfv1.3.0authorizesessionCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0authorizesessionCloud:
      title: ocsfv1.3.0authorizesessionCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0authorizesessionContainer:
      title: ocsfv1.3.0authorizesessionContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0authorizesessionCve:
      title: ocsfv1.3.0authorizesessionCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0authorizesessionCvss:
      title: ocsfv1.3.0authorizesessionCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0authorizesessionCvss_Depth:
      title: ocsfv1.3.0authorizesessionCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0authorizesessionCwe:
      title: ocsfv1.3.0authorizesessionCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0authorizesessionDevice:
      title: ocsfv1.3.0authorizesessionDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0authorizesessionDevice_NetworkStatusId:
      title: ocsfv1.3.0authorizesessionDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0authorizesessionDevice_RiskLevelId:
      title: ocsfv1.3.0authorizesessionDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authorizesessionDevice_TypeId:
      title: ocsfv1.3.0authorizesessionDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0authorizesessionDeviceHwInfo:
      title: ocsfv1.3.0authorizesessionDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0authorizesessionDigitalSignature:
      title: ocsfv1.3.0authorizesessionDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0authorizesessionDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0authorizesessionDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authorizesessionDigitalSignature_StateId:
      title: ocsfv1.3.0authorizesessionDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authorizesessionDisplay:
      title: ocsfv1.3.0authorizesessionDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0authorizesessionDnsAnswer:
      title: ocsfv1.3.0authorizesessionDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0authorizesessionDnsAnswer_FlagIds:
      title: ocsfv1.3.0authorizesessionDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authorizesessionDomainContact:
      title: ocsfv1.3.0authorizesessionDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0authorizesessionDomainContact_TypeId:
      title: ocsfv1.3.0authorizesessionDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionEmail:
      title: ocsfv1.3.0authorizesessionEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0authorizesessionEmailAuth:
      title: ocsfv1.3.0authorizesessionEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0authorizesessionEnrichment:
      title: ocsfv1.3.0authorizesessionEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0authorizesessionEpss:
      title: ocsfv1.3.0authorizesessionEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0authorizesessionExtension:
      title: ocsfv1.3.0authorizesessionExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0authorizesessionFeature:
      title: ocsfv1.3.0authorizesessionFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0authorizesessionFile:
      title: ocsfv1.3.0authorizesessionFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0authorizesessionFile_ConfidentialityId:
      title: ocsfv1.3.0authorizesessionFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionFile_TypeId:
      title: ocsfv1.3.0authorizesessionFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionFingerprint:
      title: ocsfv1.3.0authorizesessionFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0authorizesessionFingerprint_AlgorithmId:
      title: ocsfv1.3.0authorizesessionFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0authorizesessionGroup:
      title: ocsfv1.3.0authorizesessionGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0authorizesessionHttpHeader:
      title: ocsfv1.3.0authorizesessionHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0authorizesessionHttpRequest:
      title: ocsfv1.3.0authorizesessionHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionHttpRequest_HttpMethod
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0authorizesessionHttpRequest_HttpMethod:
      title: ocsfv1.3.0authorizesessionHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0authorizesessionIdp:
      title: ocsfv1.3.0authorizesessionIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0authorizesessionImage:
      title: ocsfv1.3.0authorizesessionImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0authorizesessionKbArticle:
      title: ocsfv1.3.0authorizesessionKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0authorizesessionKbArticle_InstallStateId:
      title: ocsfv1.3.0authorizesessionKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionKeyboardInfo:
      title: ocsfv1.3.0authorizesessionKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0authorizesessionKillChainPhase:
      title: ocsfv1.3.0authorizesessionKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0authorizesessionKillChainPhase_PhaseId:
      title: ocsfv1.3.0authorizesessionKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authorizesessionLdapPerson:
      title: ocsfv1.3.0authorizesessionLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0authorizesessionLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0authorizesessionLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionLocation:
      title: ocsfv1.3.0authorizesessionLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0authorizesessionLogger:
      title: ocsfv1.3.0authorizesessionLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0authorizesessionMetadata:
      title: ocsfv1.3.0authorizesessionMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0authorizesessionMetric:
      title: ocsfv1.3.0authorizesessionMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0authorizesessionNetworkEndpoint:
      title: ocsfv1.3.0authorizesessionNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionNetworkEndpoint_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0authorizesessionNetworkEndpoint_TypeId:
      title: ocsfv1.3.0authorizesessionNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0authorizesessionNetworkInterface:
      title: ocsfv1.3.0authorizesessionNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0authorizesessionNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0authorizesessionNetworkInterface_TypeId:
      title: ocsfv1.3.0authorizesessionNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionNetworkProxy:
      title: ocsfv1.3.0authorizesessionNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0authorizesessionNetworkProxy_TypeId:
      title: ocsfv1.3.0authorizesessionNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0authorizesessionObject:
      title: ocsfv1.3.0authorizesessionObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0authorizesessionObservable:
      title: ocsfv1.3.0authorizesessionObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0authorizesessionObservable_TypeId:
      title: ocsfv1.3.0authorizesessionObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0authorizesessionOrganization:
      title: ocsfv1.3.0authorizesessionOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0authorizesessionOs:
      title: ocsfv1.3.0authorizesessionOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0authorizesessionOs_TypeId:
      title: ocsfv1.3.0authorizesessionOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0authorizesessionOsint:
      title: ocsfv1.3.0authorizesessionOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0authorizesessionOsint_ConfidenceId:
      title: ocsfv1.3.0authorizesessionOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionOsint_Tlp:
      title: ocsfv1.3.0authorizesessionOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0authorizesessionOsint_TypeId:
      title: ocsfv1.3.0authorizesessionOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0authorizesessionPackage:
      title: ocsfv1.3.0authorizesessionPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0authorizesessionPackage_TypeId:
      title: ocsfv1.3.0authorizesessionPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionPolicy:
      title: ocsfv1.3.0authorizesessionPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0authorizesessionProcess:
      title: ocsfv1.3.0authorizesessionProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0authorizesessionProcess_IntegrityId:
      title: ocsfv1.3.0authorizesessionProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authorizesessionProduct:
      title: ocsfv1.3.0authorizesessionProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0authorizesessionRemediation:
      title: ocsfv1.3.0authorizesessionRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0authorizesessionReputation:
      title: ocsfv1.3.0authorizesessionReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0authorizesessionReputation_ScoreId:
      title: ocsfv1.3.0authorizesessionReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authorizesessionRequest:
      title: ocsfv1.3.0authorizesessionRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0authorizesessionResponse:
      title: ocsfv1.3.0authorizesessionResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0authorizesessionService:
      title: ocsfv1.3.0authorizesessionService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0authorizesessionSession:
      title: ocsfv1.3.0authorizesessionSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0authorizesessionSubTechnique:
      title: ocsfv1.3.0authorizesessionSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0authorizesessionTactic:
      title: ocsfv1.3.0authorizesessionTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0authorizesessionTechnique:
      title: ocsfv1.3.0authorizesessionTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0authorizesessionTimespan:
      title: ocsfv1.3.0authorizesessionTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0authorizesessionTimespan_TypeId:
      title: ocsfv1.3.0authorizesessionTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionUrl:
      title: ocsfv1.3.0authorizesessionUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0authorizesessionUrl_CategoryIds:
      title: ocsfv1.3.0authorizesessionUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0authorizesessionUser:
      title: ocsfv1.3.0authorizesessionUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0authorizesessionUser_MfaStatusId:
      title: ocsfv1.3.0authorizesessionUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionUser_RiskLevelId:
      title: ocsfv1.3.0authorizesessionUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0authorizesessionUser_TypeId:
      title: ocsfv1.3.0authorizesessionUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0authorizesessionUser_UserStatusId:
      title: ocsfv1.3.0authorizesessionUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0authorizesessionVulnerability:
      title: ocsfv1.3.0authorizesessionVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0authorizesessionWhois:
      title: ocsfv1.3.0authorizesessionWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0authorizesessionDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0authorizesessionSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0authorizesessionWhois_DnssecStatusId:
      title: ocsfv1.3.0authorizesessionWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventEmailAddress:
      title: ocsfv1.3.0baseeventEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0baseeventFileName:
      title: ocsfv1.3.0baseeventFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0baseeventHash:
      title: ocsfv1.3.0baseeventHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0baseeventHostname:
      title: ocsfv1.3.0baseeventHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0baseeventIPAddress:
      title: ocsfv1.3.0baseeventIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0baseeventMACAddress:
      title: ocsfv1.3.0baseeventMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0baseeventPort:
      title: ocsfv1.3.0baseeventPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0baseeventSubnet:
      title: ocsfv1.3.0baseeventSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0baseeventTimestamp:
      title: ocsfv1.3.0baseeventTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0baseeventURLString:
      title: ocsfv1.3.0baseeventURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0baseeventUserName:
      title: ocsfv1.3.0baseeventUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0baseeventActivityId:
      title: ocsfv1.3.0baseeventActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventBaseEvent:
      title: ocsfv1.3.0baseeventBaseEvent
      type: object
      description: >-
        The base event is a generic and concrete event. It also defines a set of
        attributes available in most event classes. As a generic event that does
        not belong to any event category, it could be used to log events that
        are not otherwise defined by the schema.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: The event category name, as defined by category_uid value.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventObject'
          nullable: true
          description: A list of custom fields
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          type: integer
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0baseeventCategoryUid:
      title: ocsfv1.3.0baseeventCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        0 - Uncategorized
    ocsfv1.3.0baseeventClassUid:
      title: ocsfv1.3.0baseeventClassUid
      type: integer
      description: |-
        ClassUid is an enum, and the following values are allowed.
        0 - BaseEvent
    ocsfv1.3.0baseeventSeverityId:
      title: ocsfv1.3.0baseeventSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0baseeventStatusId:
      title: ocsfv1.3.0baseeventStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0baseeventAccount:
      title: ocsfv1.3.0baseeventAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0baseeventAccount_TypeId:
      title: ocsfv1.3.0baseeventAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0baseeventAffectedCode:
      title: ocsfv1.3.0baseeventAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0baseeventAffectedPackage:
      title: ocsfv1.3.0baseeventAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0baseeventAffectedPackage_TypeId:
      title: ocsfv1.3.0baseeventAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventAgent:
      title: ocsfv1.3.0baseeventAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0baseeventAgent_TypeId:
      title: ocsfv1.3.0baseeventAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventApi:
      title: ocsfv1.3.0baseeventApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0baseeventAttack:
      title: ocsfv1.3.0baseeventAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0baseeventAutonomousSystem:
      title: ocsfv1.3.0baseeventAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0baseeventCertificate:
      title: ocsfv1.3.0baseeventCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0baseeventCloud:
      title: ocsfv1.3.0baseeventCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0baseeventContainer:
      title: ocsfv1.3.0baseeventContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0baseeventCve:
      title: ocsfv1.3.0baseeventCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0baseeventCvss:
      title: ocsfv1.3.0baseeventCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0baseeventCvss_Depth:
      title: ocsfv1.3.0baseeventCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0baseeventCwe:
      title: ocsfv1.3.0baseeventCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0baseeventDevice:
      title: ocsfv1.3.0baseeventDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0baseeventDevice_NetworkStatusId:
      title: ocsfv1.3.0baseeventDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0baseeventDevice_RiskLevelId:
      title: ocsfv1.3.0baseeventDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0baseeventDevice_TypeId:
      title: ocsfv1.3.0baseeventDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0baseeventDeviceHwInfo:
      title: ocsfv1.3.0baseeventDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0baseeventDigitalSignature:
      title: ocsfv1.3.0baseeventDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDigitalSignature_AlgorithmId'
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0baseeventDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0baseeventDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0baseeventDigitalSignature_StateId:
      title: ocsfv1.3.0baseeventDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0baseeventDisplay:
      title: ocsfv1.3.0baseeventDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0baseeventDnsAnswer:
      title: ocsfv1.3.0baseeventDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0baseeventDnsAnswer_FlagIds:
      title: ocsfv1.3.0baseeventDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0baseeventDomainContact:
      title: ocsfv1.3.0baseeventDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0baseeventDomainContact_TypeId:
      title: ocsfv1.3.0baseeventDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventEmail:
      title: ocsfv1.3.0baseeventEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0baseeventEmailAuth:
      title: ocsfv1.3.0baseeventEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0baseeventEnrichment:
      title: ocsfv1.3.0baseeventEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0baseeventEpss:
      title: ocsfv1.3.0baseeventEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0baseeventExtension:
      title: ocsfv1.3.0baseeventExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0baseeventFeature:
      title: ocsfv1.3.0baseeventFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0baseeventFile:
      title: ocsfv1.3.0baseeventFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0baseeventFile_ConfidentialityId:
      title: ocsfv1.3.0baseeventFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventFile_TypeId:
      title: ocsfv1.3.0baseeventFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventFingerprint:
      title: ocsfv1.3.0baseeventFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0baseeventFingerprint_AlgorithmId:
      title: ocsfv1.3.0baseeventFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0baseeventGroup:
      title: ocsfv1.3.0baseeventGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0baseeventImage:
      title: ocsfv1.3.0baseeventImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0baseeventKbArticle:
      title: ocsfv1.3.0baseeventKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0baseeventKbArticle_InstallStateId:
      title: ocsfv1.3.0baseeventKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventKeyboardInfo:
      title: ocsfv1.3.0baseeventKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0baseeventKillChainPhase:
      title: ocsfv1.3.0baseeventKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0baseeventKillChainPhase_PhaseId:
      title: ocsfv1.3.0baseeventKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0baseeventLdapPerson:
      title: ocsfv1.3.0baseeventLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0baseeventLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0baseeventLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0baseeventLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventLocation:
      title: ocsfv1.3.0baseeventLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0baseeventLogger:
      title: ocsfv1.3.0baseeventLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0baseeventMetadata:
      title: ocsfv1.3.0baseeventMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0baseeventMetric:
      title: ocsfv1.3.0baseeventMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0baseeventNetworkInterface:
      title: ocsfv1.3.0baseeventNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0baseeventNetworkInterface_TypeId:
      title: ocsfv1.3.0baseeventNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventObject:
      title: ocsfv1.3.0baseeventObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0baseeventObservable:
      title: ocsfv1.3.0baseeventObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0baseeventObservable_TypeId:
      title: ocsfv1.3.0baseeventObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0baseeventOrganization:
      title: ocsfv1.3.0baseeventOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0baseeventOs:
      title: ocsfv1.3.0baseeventOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0baseeventOs_TypeId:
      title: ocsfv1.3.0baseeventOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0baseeventOsint:
      title: ocsfv1.3.0baseeventOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0baseeventOsint_ConfidenceId:
      title: ocsfv1.3.0baseeventOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventOsint_Tlp:
      title: ocsfv1.3.0baseeventOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0baseeventOsint_TypeId:
      title: ocsfv1.3.0baseeventOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0baseeventPackage:
      title: ocsfv1.3.0baseeventPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0baseeventPackage_TypeId:
      title: ocsfv1.3.0baseeventPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventProduct:
      title: ocsfv1.3.0baseeventProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0baseeventRemediation:
      title: ocsfv1.3.0baseeventRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0baseeventReputation:
      title: ocsfv1.3.0baseeventReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0baseeventReputation_ScoreId:
      title: ocsfv1.3.0baseeventReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0baseeventRequest:
      title: ocsfv1.3.0baseeventRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0baseeventResponse:
      title: ocsfv1.3.0baseeventResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0baseeventService:
      title: ocsfv1.3.0baseeventService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0baseeventSubTechnique:
      title: ocsfv1.3.0baseeventSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0baseeventTactic:
      title: ocsfv1.3.0baseeventTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0baseeventTechnique:
      title: ocsfv1.3.0baseeventTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0baseeventTimespan:
      title: ocsfv1.3.0baseeventTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0baseeventTimespan_TypeId:
      title: ocsfv1.3.0baseeventTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventUrl:
      title: ocsfv1.3.0baseeventUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0baseeventUrl_CategoryIds:
      title: ocsfv1.3.0baseeventUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0baseeventUser:
      title: ocsfv1.3.0baseeventUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0baseeventUser_MfaStatusId:
      title: ocsfv1.3.0baseeventUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventUser_RiskLevelId:
      title: ocsfv1.3.0baseeventUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0baseeventUser_TypeId:
      title: ocsfv1.3.0baseeventUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0baseeventUser_UserStatusId:
      title: ocsfv1.3.0baseeventUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0baseeventVulnerability:
      title: ocsfv1.3.0baseeventVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0baseeventWhois:
      title: ocsfv1.3.0baseeventWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0baseeventDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0baseeventSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0baseeventWhois_DnssecStatusId:
      title: ocsfv1.3.0baseeventWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityEmailAddress:
      title: ocsfv1.3.0cloudactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0cloudactivityFileName:
      title: ocsfv1.3.0cloudactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0cloudactivityHash:
      title: ocsfv1.3.0cloudactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0cloudactivityHostname:
      title: ocsfv1.3.0cloudactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0cloudactivityIPAddress:
      title: ocsfv1.3.0cloudactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0cloudactivityMACAddress:
      title: ocsfv1.3.0cloudactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0cloudactivityPort:
      title: ocsfv1.3.0cloudactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0cloudactivityProcessName:
      title: ocsfv1.3.0cloudactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0cloudactivitySubnet:
      title: ocsfv1.3.0cloudactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0cloudactivityTimestamp:
      title: ocsfv1.3.0cloudactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0cloudactivityURLString:
      title: ocsfv1.3.0cloudactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0cloudactivityUserName:
      title: ocsfv1.3.0cloudactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0cloudactivityActivityId:
      title: ocsfv1.3.0cloudactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Authorize: An authorizaon check was performed.

        2 - Create: A resource was created.

        3 - Update: One or more web resources were updated.

        4 - Delete: One or more web resources were deleted.

        5 - Send: A resource was sent to an external destination.

        6 - Upload: A resource was uploaded from an external source.

        7 - Download: A resource was downloaded to an external source.

        8 - MetadataChange: The metadata of a resource was changed.

        9 - SharingChange: The sharing status of a resource was changed.

        10 - Read: A resource was accessed.

        11 - Install: An application was installed.

        12 - Uninstall: An application was uninstalled.

        13 - MembershipChange: The membership relating to a resource was
        changed.

        14 - Informational: An informational event was logged.

        15 - Export: A resource was exported.

        16 - Execute: A task, action, or script was executed.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityCategoryUid:
      title: ocsfv1.3.0cloudactivityCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        6 - ApplicationActivity: Application Activity events report detailed
        information about the behavior of applications and services.
    ocsfv1.3.0cloudactivityClassUid:
      title: ocsfv1.3.0cloudactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        6090 - CloudActivity: Cloud activity events report events and actions
        logged or collected from a cloud environment. This class is based on Web
        Resources Activity, but is more broad and suited to event logs with
        diverse types of data available.
    ocsfv1.3.0cloudactivityCloudActivity:
      title: ocsfv1.3.0cloudactivityCloudActivity
      type: object
      description: >-
        Cloud activity events report events and actions logged or collected from
        a cloud environment. This class is based on Web Resources Activity, but
        is more broad and suited to event logs with diverse types of data
        available.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActor'
          nullable: true
          description: >-
            The actor which initiated or caused the action or event, as used in
            3001/Account Change.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Application Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDevice'
          nullable: true
          description: >-
            The device which was used by the user to cause the event, or which
            the event is otherwise about or related to.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkEndpoint'
          nullable: true
          description: Details about server providing the web resources.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmail'
          nullable: true
          description: >-
            An email which related to the event, such as a mail that was sent,
            scanned, or caused by the event.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        file:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFile'
          nullable: true
          description: >-
            The file which is related to the event, such as an uploaded,
            downloaded, deleted, or modified file.
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        http_response:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHttpResponse'
          nullable: true
          description: Details about the HTTP response, if available.
        meeting:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMeeting'
          nullable: true
          description: >-
            Information relating to a meeting, such as attendees, start/end
            times, and meeting details.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        messaging:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMessaging'
          nullable: true
          description: >-
            Information related to instant messaging, such as sending messages,
            adding users to channels, etc.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        parameters:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            A place to store parameters which were passed to a command,
            application, program, etc. This could include CLI parameters, the
            configuration used to launch an app, etc.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        sharing:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySharing'
          nullable: true
          description: >-
            Information about how and with whom a resource was shared, such as
            sharing permissions and scope.
        src_app:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: >-
            The app which initiated or caused an action or event, such as the
            client.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkEndpoint'
          nullable: true
          description: Details about the endpoint from which the request originated.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        target_app:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: >-
            The app which is the target of the action or event. For example,
            when a user adds an app to Teams, the app which was added would be
            the target app, and Teams would be the source app.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        tls:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTls'
          nullable: true
          description: The Transport Layer Security (TLS) attributes, if available.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        web_resources:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityWebResource'
          description: >-
            Describes details about web resources that were affected by an
            activity/event.
        web_resources_result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityWebResource'
          nullable: true
          description: >-
            The results of the activity on web resources. It should contain the
            new values of the changed attributes of the web resources.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
        - web_resources
    ocsfv1.3.0cloudactivitySeverityId:
      title: ocsfv1.3.0cloudactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0cloudactivityStatusId:
      title: ocsfv1.3.0cloudactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0cloudactivityTypeUid:
      title: ocsfv1.3.0cloudactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        609000 - Unknown

        609001 - Authorize: An authorizaon check was performed.

        609002 - Create: A resource was created.

        609003 - Update: One or more web resources were updated.

        609004 - Delete: One or more web resources were deleted.

        609005 - Send: A resource was sent to an external destination.

        609006 - Upload: A resource was uploaded from an external source.

        609007 - Download: A resource was downloaded to an external source.

        609008 - MetadataChange: The metadata of a resource was changed.

        609009 - SharingChange: The sharing status of a resource was changed.

        609010 - Read: A resource was accessed.

        609011 - Install: An application was installed.

        609012 - Uninstall: An application was uninstalled.

        609013 - MembershipChange: The membership relating to a resource was
        changed.

        609014 - Informational: An informational event was logged.

        609015 - Export: A resource was exported.

        609016 - Execute: A task, action, or script was executed.

        609099 - Other
    ocsfv1.3.0cloudactivityAccount:
      title: ocsfv1.3.0cloudactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0cloudactivityAccount_TypeId:
      title: ocsfv1.3.0cloudactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0cloudactivityActor:
      title: ocsfv1.3.0cloudactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0cloudactivityActor_ActorTypeId:
      title: ocsfv1.3.0cloudactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityAffectedCode:
      title: ocsfv1.3.0cloudactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0cloudactivityAffectedPackage:
      title: ocsfv1.3.0cloudactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0cloudactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0cloudactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityAgent:
      title: ocsfv1.3.0cloudactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0cloudactivityAgent_TypeId:
      title: ocsfv1.3.0cloudactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityApi:
      title: ocsfv1.3.0cloudactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0cloudactivityAttack:
      title: ocsfv1.3.0cloudactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0cloudactivityAuthorization:
      title: ocsfv1.3.0cloudactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0cloudactivityAutonomousSystem:
      title: ocsfv1.3.0cloudactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0cloudactivityCertificate:
      title: ocsfv1.3.0cloudactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0cloudactivityCloud:
      title: ocsfv1.3.0cloudactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0cloudactivityContainer:
      title: ocsfv1.3.0cloudactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0cloudactivityCve:
      title: ocsfv1.3.0cloudactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0cloudactivityCvss:
      title: ocsfv1.3.0cloudactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0cloudactivityCvss_Depth:
      title: ocsfv1.3.0cloudactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0cloudactivityCwe:
      title: ocsfv1.3.0cloudactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0cloudactivityDevice:
      title: ocsfv1.3.0cloudactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0cloudactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0cloudactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0cloudactivityDevice_RiskLevelId:
      title: ocsfv1.3.0cloudactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0cloudactivityDevice_TypeId:
      title: ocsfv1.3.0cloudactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0cloudactivityDeviceHwInfo:
      title: ocsfv1.3.0cloudactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0cloudactivityDigitalSignature:
      title: ocsfv1.3.0cloudactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0cloudactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0cloudactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0cloudactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0cloudactivityDigitalSignature_StateId:
      title: ocsfv1.3.0cloudactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0cloudactivityDisplay:
      title: ocsfv1.3.0cloudactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0cloudactivityDnsAnswer:
      title: ocsfv1.3.0cloudactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0cloudactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0cloudactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0cloudactivityDomainContact:
      title: ocsfv1.3.0cloudactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0cloudactivityDomainContact_TypeId:
      title: ocsfv1.3.0cloudactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityEmail:
      title: ocsfv1.3.0cloudactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0cloudactivityEmailAuth:
      title: ocsfv1.3.0cloudactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0cloudactivityEnrichment:
      title: ocsfv1.3.0cloudactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0cloudactivityEpss:
      title: ocsfv1.3.0cloudactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0cloudactivityExtension:
      title: ocsfv1.3.0cloudactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0cloudactivityFeature:
      title: ocsfv1.3.0cloudactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0cloudactivityFile:
      title: ocsfv1.3.0cloudactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0cloudactivityFile_ConfidentialityId:
      title: ocsfv1.3.0cloudactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityFile_TypeId:
      title: ocsfv1.3.0cloudactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityFingerprint:
      title: ocsfv1.3.0cloudactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0cloudactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0cloudactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0cloudactivityGroup:
      title: ocsfv1.3.0cloudactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0cloudactivityHttpHeader:
      title: ocsfv1.3.0cloudactivityHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0cloudactivityHttpRequest:
      title: ocsfv1.3.0cloudactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0cloudactivityHttpRequest_HttpMethod:
      title: ocsfv1.3.0cloudactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0cloudactivityHttpResponse:
      title: ocsfv1.3.0cloudactivityHttpResponse
      type: object
      description: >-
        The HTTP Response object contains detailed information about the
        response sent from a web server to the requester. It encompasses
        attributes and metadata that describe the response status, headers, body
        content, and other relevant information.
      properties:
        code:
          type: integer
          description: >-
            The Hypertext Transfer Protocol (HTTP) status code returned from the
            web server to the client. For example, 200.
        content_type:
          type: string
          nullable: true
          description: >-
            The request header that identifies the original <a target="_blank"
            href="https://www.iana.org/assignments/media-types/media-types.xhtml">media
            type </a> of the resource (prior to any content encoding applied for
            sending).
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        latency:
          type: integer
          nullable: true
          description: The HTTP response latency measured in milliseconds.
        length:
          type: integer
          nullable: true
          description: The HTTP response length, in number of bytes.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        status:
          type: string
          nullable: true
          description: >-
            The response status. For example: A successful HTTP status of 'OK'
            which corresponds to a code of 200.
      required:
        - code
    ocsfv1.3.0cloudactivityIdp:
      title: ocsfv1.3.0cloudactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0cloudactivityImage:
      title: ocsfv1.3.0cloudactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0cloudactivityKbArticle:
      title: ocsfv1.3.0cloudactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0cloudactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0cloudactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityKeyboardInfo:
      title: ocsfv1.3.0cloudactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0cloudactivityKillChainPhase:
      title: ocsfv1.3.0cloudactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0cloudactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0cloudactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0cloudactivityLdapPerson:
      title: ocsfv1.3.0cloudactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0cloudactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0cloudactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0cloudactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityLocation:
      title: ocsfv1.3.0cloudactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0cloudactivityLogger:
      title: ocsfv1.3.0cloudactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0cloudactivityMeeting:
      title: ocsfv1.3.0cloudactivityMeeting
      type: object
      description: >-
        The Meeting object encompasses information relating to a meeting, such
        as might be present in typical office calendar software like Teams,
        Outlook, Google Calendar, etc.
      properties:
        attendees:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMeetingAttendee'
          nullable: true
          description: Actors who are attendees of the meeting.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: Time at which the meeting is scheduled to end.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Time at which the meeting is scheduled to end.
        name:
          type: string
          nullable: true
          description: The meeting's display name.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: Time at which the meeting is scheduled to begin.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Time at which the meeting is scheduled to begin.
        uid:
          type: string
          nullable: true
          description: Unique ID associated with the meeting.
        urls:
          type: array
          items:
            type: string
          nullable: true
          description: URLs associated with the meeting, e.g. video conference links.
    ocsfv1.3.0cloudactivityMeetingAttendee:
      title: ocsfv1.3.0cloudactivityMeetingAttendee
      type: object
      description: >-
        The Meeting Attendee object encompasses information related to a meeting
        attendee.
      properties:
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActor'
          nullable: true
          description: The actor corresponding to the entity joining the meeting.
        device:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDevice'
          nullable: true
          description: Information about the attendee's device.
        invited_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: When the actor was invited to the meeting.
        invited_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the actor was invited to the meeting.
        inviter:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActor'
          nullable: true
          description: The actor who invited the attendee to the meeting.
        join_times:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: Time(s) at which the attendee joined the meeting.
        join_times_dt:
          type: array
          items:
            type: string
            format: date-time
          nullable: true
          description: Time(s) at which the attendee joined the meeting.
        leave_times:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: Time(s) at which the attendee left the meeting.
        leave_times_dt:
          type: array
          items:
            type: string
            format: date-time
          nullable: true
          description: Time(s) at which the attendee left the meeting.
    ocsfv1.3.0cloudactivityMessaging:
      title: ocsfv1.3.0cloudactivityMessaging
      type: object
      description: >-
        The Messaging object encompasses information related to instant
        messaging, such as sending messages, adding a user to a channel, etc.
      properties:
        channel_name:
          type: string
          nullable: true
          description: Name of the channel that the event pertains to.
        channel_uid:
          type: string
          nullable: true
          description: ID of the channel that the event pertains to.
        domains:
          type: array
          items:
            type: string
          nullable: true
          description: List of domains participating in the chat session.
        has_foreign_tenant_users:
          type: boolean
          nullable: true
          description: >-
            True if the event pertains to a channel or group which contains
            users from a foreign tenant.
        has_guest_users:
          type: boolean
          nullable: true
          description: >-
            True if the event pertains to a channel or group which contains
            guest users.
        has_unauthenticated_users:
          type: boolean
          nullable: true
          description: >-
            True if the event pertains to a channel or group which contains
            users that are not authenticated.
        members:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActor'
          nullable: true
          description: Actors to whom the event pertains.
        message_urls:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            URLs contained in the messages which are relevant to the chat
            session or event.
        session_name:
          type: string
          nullable: true
          description: >-
            Name of the session that the event pertains to, e.g. a chat specific
            to a meeting, or a thread within a channel.
        session_uid:
          type: string
          nullable: true
          description: ID of the session.
        uid:
          type: string
          nullable: true
          description: UID of the event, e.g. unique message ID.
    ocsfv1.3.0cloudactivityMetadata:
      title: ocsfv1.3.0cloudactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0cloudactivityMetric:
      title: ocsfv1.3.0cloudactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0cloudactivityNetworkEndpoint:
      title: ocsfv1.3.0cloudactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0cloudactivityNetworkEndpoint_TypeId:
      title: ocsfv1.3.0cloudactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0cloudactivityNetworkInterface:
      title: ocsfv1.3.0cloudactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0cloudactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0cloudactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityNetworkProxy:
      title: ocsfv1.3.0cloudactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0cloudactivityNetworkProxy_TypeId:
      title: ocsfv1.3.0cloudactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0cloudactivityObject:
      title: ocsfv1.3.0cloudactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0cloudactivityObservable:
      title: ocsfv1.3.0cloudactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0cloudactivityObservable_TypeId:
      title: ocsfv1.3.0cloudactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0cloudactivityOrganization:
      title: ocsfv1.3.0cloudactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0cloudactivityOs:
      title: ocsfv1.3.0cloudactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0cloudactivityOs_TypeId:
      title: ocsfv1.3.0cloudactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0cloudactivityOsint:
      title: ocsfv1.3.0cloudactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0cloudactivityOsint_ConfidenceId:
      title: ocsfv1.3.0cloudactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityOsint_Tlp:
      title: ocsfv1.3.0cloudactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0cloudactivityOsint_TypeId:
      title: ocsfv1.3.0cloudactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0cloudactivityPackage:
      title: ocsfv1.3.0cloudactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0cloudactivityPackage_TypeId:
      title: ocsfv1.3.0cloudactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityPolicy:
      title: ocsfv1.3.0cloudactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0cloudactivityProcess:
      title: ocsfv1.3.0cloudactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0cloudactivityProcess_IntegrityId:
      title: ocsfv1.3.0cloudactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0cloudactivityProduct:
      title: ocsfv1.3.0cloudactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0cloudactivityRemediation:
      title: ocsfv1.3.0cloudactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0cloudactivityReputation:
      title: ocsfv1.3.0cloudactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0cloudactivityReputation_ScoreId:
      title: ocsfv1.3.0cloudactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0cloudactivityRequest:
      title: ocsfv1.3.0cloudactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0cloudactivityResponse:
      title: ocsfv1.3.0cloudactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0cloudactivitySan:
      title: ocsfv1.3.0cloudactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.3.0cloudactivityService:
      title: ocsfv1.3.0cloudactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0cloudactivitySession:
      title: ocsfv1.3.0cloudactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0cloudactivitySharing:
      title: ocsfv1.3.0cloudactivitySharing
      type: object
      description: >-
        The Sharing object encompasses information about how and with whom a
        resource was shared.
      properties:
        actors:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityActor'
          nullable: true
          description: >-
            The actor(s) with whom the resource has been shared. Note that with
            the addition of groups to the Actor object, sharing with a group can
            be represented by an Actor object with an empty user field and a
            populated groups field.
        anonymous:
          type: boolean
          nullable: true
          description: True if anonymous access is enabled for sharing.
        can_reshare:
          type: boolean
          nullable: true
          description: True if the recipients have permission to re-share the resource.
        link_id:
          type: string
          nullable: true
          description: Unique ID of a sharing link.
        permissions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySharingPermission'
          nullable: true
          description: List of permissions granted.
        scope:
          type: string
          nullable: true
          description: The scope, normalized to the caption of the scope_id value.
        scope_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySharing_ScopeId'
          nullable: true
          description: The normalized identifier of the sharing scope.
        sharing_action:
          type: string
          nullable: true
          description: >-
            Describes the nature of a sharing action, such as creating a link
            for others to access a resource.
    ocsfv1.3.0cloudactivitySharing_ScopeId:
      title: ocsfv1.3.0cloudactivitySharing_ScopeId
      type: integer
      description: |-
        SharingScopeId is an enum, and the following values are allowed.
        0 - Unknown: The scope is unknown.
        1 - User: User scope.
        2 - Group: Group scope.
        3 - Tenant: Tenant scope.
        4 - Organization: Organization scope.
        5 - World: World scope.
        99 - Other: The scope is not mapped.
    ocsfv1.3.0cloudactivitySharingPermission:
      title: ocsfv1.3.0cloudactivitySharingPermission
      type: object
      description: >-
        The Sharing Permission type represents the permissions granted to
        recipients via a Sharing object.
      properties:
        sharing_permission_type:
          type: string
          nullable: true
          description: >-
            The sharing permission type, normalized to the caption of the
            sharing_permission_type_id value.
        sharing_permission_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0cloudactivitySharingPermission_SharingPermissionTypeId
          description: The normalized identifier of the sharing permission type.
      required:
        - sharing_permission_type_id
    ocsfv1.3.0cloudactivitySharingPermission_SharingPermissionTypeId:
      title: ocsfv1.3.0cloudactivitySharingPermission_SharingPermissionTypeId
      type: integer
      description: >-
        SharingPermissionSharingPermissionTypeId is an enum, and the following
        values are allowed.

        0 - Unknown: The sharing permission type is unknown.

        1 - View: View permission.

        2 - Modify: Modify permission.

        99 - Other: The sharing permission type is not mapped.
    ocsfv1.3.0cloudactivitySubTechnique:
      title: ocsfv1.3.0cloudactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0cloudactivityTactic:
      title: ocsfv1.3.0cloudactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0cloudactivityTechnique:
      title: ocsfv1.3.0cloudactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0cloudactivityTimespan:
      title: ocsfv1.3.0cloudactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0cloudactivityTimespan_TypeId:
      title: ocsfv1.3.0cloudactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityTls:
      title: ocsfv1.3.0cloudactivityTls
      type: object
      description: >-
        The Transport Layer Security (TLS) object describes the negotiated TLS
        protocol used for secure communications over an establish network
        connection.
      properties:
        alert:
          type: integer
          nullable: true
          description: >-
            The integer value of TLS alert if present. The alerts are defined in
            the TLS specification in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc2246">RFC-2246</a>.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        certificate_chain:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Chain of Certificate Serial Numbers field provides a chain of
            Certificate Issuer Serial Numbers leading to the Root Certificate
            Issuer.
        cipher:
          type: string
          nullable: true
          description: The negotiated cipher suite.
        client_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The client cipher suites that were exchanged during the TLS
            handshake negotiation.
        extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        handshake_dur:
          type: integer
          nullable: true
          description: >-
            The amount of total time for the TLS handshake to complete after the
            TCP connection is established, including client-side delays, in
            milliseconds.
        ja3_hash:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3 string.
        ja3s_hash:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3S string.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        server_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The server cipher suites that were exchanged during the TLS
            handshake negotiation.
        sni:
          type: string
          nullable: true
          description: The Server Name Indication (SNI) extension sent by the client.
        tls_extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        version:
          type: string
          description: The TLS protocol version.
      required:
        - version
    ocsfv1.3.0cloudactivityTlsExtension:
      title: ocsfv1.3.0cloudactivityTlsExtension
      type: object
      description: >-
        The TLS Extension object describes additional attributes that extend the
        base Transport Layer Security (TLS) object.
      properties:
        data:
          nullable: true
          description: >-
            The data contains information specific to the particular extension
            type.
        type:
          type: string
          nullable: true
          description: 'The TLS extension type. For example: <code>Server Name</code>.'
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTlsExtension_TypeId'
          description: >-
            The TLS extension type identifier. See <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc8446#page-35'>The
            Transport Layer Security (TLS) extension page</a>.
      required:
        - type_id
    ocsfv1.3.0cloudactivityTlsExtension_TypeId:
      title: ocsfv1.3.0cloudactivityTlsExtension_TypeId
      type: integer
      description: >-
        TlsExtensionTypeId is an enum, and the following values are allowed.

        0 - name: The Server Name Indication extension.

        1 - fragment_length: The Maximum Fragment Length Negotiation extension.

        5 - request: The Certificate Status Request extension.

        10 - groups: The Supported Groups extension.

        13 - algorithms: The Signature Algorithms extension.

        14 - srtp: The Use SRTP data protection extension.

        15 - heartbeat: The Heartbeat extension.

        16 - layer_protocol_negotiation: The Application-Layer Protocol
        Negotiation extension.

        18 - certificate_timestamp: The Signed Certificate Timestamp extension.

        19 - certificate_type: The Client Certificate Type extension.

        20 - certificate_type: The Server Certificate Type extension.

        21 - padding: The Padding extension.

        41 - shared_key: The Pre Shared Key extension.

        42 - data: The Early Data extension.

        43 - versions: The Supported Versions extension.

        44 - cookie: The Cookie extension.

        45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension.

        47 - authorities: The Certificate Authorities extension.

        48 - filters: The OID Filters extension.

        49 - handshake_auth: The Post-Handshake Client Authentication extension.

        50 - algorithms_cert: The Signature Algorithms extension.

        51 - share: The Key Share extension.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityUrl:
      title: ocsfv1.3.0cloudactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0cloudactivityUrl_CategoryIds:
      title: ocsfv1.3.0cloudactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0cloudactivityUser:
      title: ocsfv1.3.0cloudactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0cloudactivityUser_MfaStatusId:
      title: ocsfv1.3.0cloudactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityUser_RiskLevelId:
      title: ocsfv1.3.0cloudactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0cloudactivityUser_TypeId:
      title: ocsfv1.3.0cloudactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0cloudactivityUser_UserStatusId:
      title: ocsfv1.3.0cloudactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0cloudactivityVulnerability:
      title: ocsfv1.3.0cloudactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0cloudactivityWebResource:
      title: ocsfv1.3.0cloudactivityWebResource
      type: object
      description: >-
        The Web Resource object describes characteristics of a web resource that
        was affected by the activity/event.
      properties:
        data:
          nullable: true
          description: >-
            Details of the web resource, e.g, <code>file</code> details,
            <code>search</code> results or application-defined resource.
        desc:
          type: string
          nullable: true
          description: Description of the web resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        name:
          type: string
          nullable: true
          description: The name of the web resource.
        type:
          type: string
          nullable: true
          description: The web resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the web resource.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityURLString'
          nullable: true
          description: The URL pointing towards the source of the web resource.
    ocsfv1.3.0cloudactivityWhois:
      title: ocsfv1.3.0cloudactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0cloudactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0cloudactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0cloudactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0cloudactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingEmailAddress:
      title: ocsfv1.3.0compliancefindingEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0compliancefindingFileName:
      title: ocsfv1.3.0compliancefindingFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0compliancefindingHash:
      title: ocsfv1.3.0compliancefindingHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0compliancefindingHostname:
      title: ocsfv1.3.0compliancefindingHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0compliancefindingIPAddress:
      title: ocsfv1.3.0compliancefindingIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0compliancefindingMACAddress:
      title: ocsfv1.3.0compliancefindingMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0compliancefindingPort:
      title: ocsfv1.3.0compliancefindingPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0compliancefindingProcessName:
      title: ocsfv1.3.0compliancefindingProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0compliancefindingSubnet:
      title: ocsfv1.3.0compliancefindingSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0compliancefindingTimestamp:
      title: ocsfv1.3.0compliancefindingTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0compliancefindingURLString:
      title: ocsfv1.3.0compliancefindingURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0compliancefindingUserName:
      title: ocsfv1.3.0compliancefindingUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0compliancefindingActivityId:
      title: ocsfv1.3.0compliancefindingActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A finding was created.

        2 - Update: A finding was updated.

        3 - Close: A finding was closed.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingCategoryUid:
      title: ocsfv1.3.0compliancefindingCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        2 - Findings: Findings events report findings, detections, and possible
        resolutions of malware, anomalies, or other actions performed by
        security products.
    ocsfv1.3.0compliancefindingClassUid:
      title: ocsfv1.3.0compliancefindingClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        2003 - ComplianceFinding: Compliance Finding events describe results of
        evaluations performed against resources, to check compliance with
        various Industry Frameworks or Security Standards such as <code>NIST SP
        800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001</code> etc.
    ocsfv1.3.0compliancefindingComplianceFinding:
      title: ocsfv1.3.0compliancefindingComplianceFinding
      type: object
      description: >-
        Compliance Finding events describe results of evaluations performed
        against resources, to check compliance with various Industry Frameworks
        or Security Standards such as <code>NIST SP 800-53, CIS AWS Foundations
        Benchmark v1.4.0, ISO/IEC 27001</code> etc.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingActivityId'
          description: The normalized identifier of the finding activity.
        activity_name:
          type: string
          nullable: true
          description: >-
            The finding activity name, as defined by the
            <code>activity_id</code>.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Findings</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        comment:
          type: string
          nullable: true
          description: A user provided comment about the finding.
        compliance:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCompliance'
          description: >-
            The compliance object provides context to compliance findings (e.g.,
            a check against a specific regulatory or best practice framework
            such as CIS, NIST etc.) and contains compliance related details.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDevice'
          nullable: true
          description: >-
            Describes the affected device/host. It can be used in conjunction
            with <code>Affected Resource(s)</code>. <p> e.g. Specific details
            about an AWS EC2 instance, that is affected by the Finding.</p>
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time of the most recent event included in the finding.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the most recent event included in the finding.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        finding_info:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFindingInfo'
          description: Describes the supporting information about a generated finding.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        resource:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingResourceDetails'
          nullable: true
          description: >-
            Describes details about the resource that is the subject of the
            compliance check.
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingResourceDetails'
          nullable: true
          description: >-
            Describes details about the resource/resouces that are the subject
            of the compliance check.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time of the least recent event included in the finding.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the least recent event included in the finding.
        status:
          type: string
          nullable: true
          description: >-
            The normalized status of the Finding set by the consumer normalized
            to the caption of the status_id value. In the case of 'Other', it is
            defined by the source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingStatusId'
          nullable: true
          description: >-
            The normalized status identifier of the Finding, set by the
            consumer.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - compliance
        - finding_info
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0compliancefindingConfidenceId:
      title: ocsfv1.3.0compliancefindingConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingSeverityId:
      title: ocsfv1.3.0compliancefindingSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0compliancefindingStatusId:
      title: ocsfv1.3.0compliancefindingStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - New: The Finding is new and yet to be reviewed.

        2 - InProgress: The Finding is under review.

        3 - Suppressed: The Finding was reviewed, determined to be benign or a
        false positive and is now suppressed.

        4 - Resolved: The Finding was reviewed, remediated and is now considered
        resolved.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0compliancefindingTypeUid:
      title: ocsfv1.3.0compliancefindingTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        200300 - Unknown
        200301 - Create: A finding was created.
        200302 - Update: A finding was updated.
        200303 - Close: A finding was closed.
        200399 - Other
    ocsfv1.3.0compliancefindingAccount:
      title: ocsfv1.3.0compliancefindingAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0compliancefindingAccount_TypeId:
      title: ocsfv1.3.0compliancefindingAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0compliancefindingActor:
      title: ocsfv1.3.0compliancefindingActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0compliancefindingActor_ActorTypeId:
      title: ocsfv1.3.0compliancefindingActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingAffectedCode:
      title: ocsfv1.3.0compliancefindingAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0compliancefindingAffectedPackage:
      title: ocsfv1.3.0compliancefindingAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0compliancefindingAffectedPackage_TypeId:
      title: ocsfv1.3.0compliancefindingAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingAgent:
      title: ocsfv1.3.0compliancefindingAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0compliancefindingAgent_TypeId:
      title: ocsfv1.3.0compliancefindingAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingAnalytic:
      title: ocsfv1.3.0compliancefindingAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.3.0compliancefindingAnalytic_TypeId:
      title: ocsfv1.3.0compliancefindingAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingApi:
      title: ocsfv1.3.0compliancefindingApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0compliancefindingAttack:
      title: ocsfv1.3.0compliancefindingAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0compliancefindingAuthorization:
      title: ocsfv1.3.0compliancefindingAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0compliancefindingAutonomousSystem:
      title: ocsfv1.3.0compliancefindingAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0compliancefindingCertificate:
      title: ocsfv1.3.0compliancefindingCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0compliancefindingCloud:
      title: ocsfv1.3.0compliancefindingCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0compliancefindingCompliance:
      title: ocsfv1.3.0compliancefindingCompliance
      type: object
      description: >-
        The Compliance object contains information about Industry and Regulatory
        Framework standards, controls and requirements.
      properties:
        compliance_references:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKbArticle'
          nullable: true
          description: >-
            A list of sources of information or tools that help organizations
            understand, interpret, and implement compliance standards. They
            provide guidance, best practices, and examples.
        compliance_standards:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKbArticle'
          nullable: true
          description: >-
            A list of established guidelines or criteria that define specific
            requirements an organization must follow.
        control:
          type: string
          nullable: true
          description: >-
            A Control is prescriptive, prioritized, and simplified set of best
            practices that one can use to strengthen their cybersecurity
            posture. e.g. AWS SecurityHub Controls, CIS Controls.
        requirements:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of requirements associated to a specific control in an
            industry or regulatory framework. e.g. <code> NIST.800-53.r5 AU-10
            </code>
        standards:
          type: array
          items:
            type: string
          description: >-
            Security standards are a set of criteria organizations can follow to
            protect sensitive and confidential information. e.g. <code>NIST SP
            800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001</code>
        status:
          type: string
          nullable: true
          description: >-
            The resultant status of the compliance check normalized to the
            caption of the <code>status_id</code> value. In the case of 'Other',
            it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: The resultant status code of the compliance check.
        status_detail:
          type: string
          nullable: true
          description: The contextual description of the status, status_code values.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCompliance_StatusId'
          nullable: true
          description: The normalized status identifier of the compliance check.
      required:
        - standards
    ocsfv1.3.0compliancefindingCompliance_StatusId:
      title: ocsfv1.3.0compliancefindingCompliance_StatusId
      type: integer
      description: >-
        ComplianceStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Pass: The compliance check passed for all the evaluated resources.

        2 - Warning: The compliance check did not yield a result due to missing
        information.

        3 - Fail: The compliance check failed for at least one of the evaluated
        resources.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0compliancefindingContainer:
      title: ocsfv1.3.0compliancefindingContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0compliancefindingCve:
      title: ocsfv1.3.0compliancefindingCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0compliancefindingCvss:
      title: ocsfv1.3.0compliancefindingCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0compliancefindingCvss_Depth:
      title: ocsfv1.3.0compliancefindingCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0compliancefindingCwe:
      title: ocsfv1.3.0compliancefindingCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0compliancefindingDevice:
      title: ocsfv1.3.0compliancefindingDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0compliancefindingDevice_NetworkStatusId:
      title: ocsfv1.3.0compliancefindingDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0compliancefindingDevice_RiskLevelId:
      title: ocsfv1.3.0compliancefindingDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0compliancefindingDevice_TypeId:
      title: ocsfv1.3.0compliancefindingDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0compliancefindingDeviceHwInfo:
      title: ocsfv1.3.0compliancefindingDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0compliancefindingDigitalSignature:
      title: ocsfv1.3.0compliancefindingDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0compliancefindingDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0compliancefindingDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0compliancefindingDigitalSignature_StateId:
      title: ocsfv1.3.0compliancefindingDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0compliancefindingDisplay:
      title: ocsfv1.3.0compliancefindingDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0compliancefindingDnsAnswer:
      title: ocsfv1.3.0compliancefindingDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0compliancefindingDnsAnswer_FlagIds:
      title: ocsfv1.3.0compliancefindingDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0compliancefindingDomainContact:
      title: ocsfv1.3.0compliancefindingDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0compliancefindingDomainContact_TypeId:
      title: ocsfv1.3.0compliancefindingDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingEmail:
      title: ocsfv1.3.0compliancefindingEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0compliancefindingEmailAuth:
      title: ocsfv1.3.0compliancefindingEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0compliancefindingEnrichment:
      title: ocsfv1.3.0compliancefindingEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0compliancefindingEpss:
      title: ocsfv1.3.0compliancefindingEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0compliancefindingExtension:
      title: ocsfv1.3.0compliancefindingExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0compliancefindingFeature:
      title: ocsfv1.3.0compliancefindingFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0compliancefindingFile:
      title: ocsfv1.3.0compliancefindingFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0compliancefindingFile_ConfidentialityId:
      title: ocsfv1.3.0compliancefindingFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingFile_TypeId:
      title: ocsfv1.3.0compliancefindingFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingFindingInfo:
      title: ocsfv1.3.0compliancefindingFindingInfo
      type: object
      description: >-
        The Finding Information object describes metadata related to a security
        finding generated by a security tool or system.
      properties:
        analytic:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAnalytic'
          nullable: true
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAttack'
          nullable: true
          description: >-
            The <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> technique and associated tactics related to the
            finding.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was created.
        data_sources:
          type: array
          items:
            type: string
          nullable: true
          description: A list of data sources utilized in generation of the finding.
        desc:
          type: string
          nullable: true
          description: The description of the reported finding.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was last modified.
        product_uid:
          type: string
          nullable: true
          description: The unique identifier of the product that reported the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAnalytic'
          nullable: true
          description: Other analytics related to this finding.
        related_events:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingRelatedEvent'
          nullable: true
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: The URL pointing to the source of the finding.
        title:
          type: string
          description: A title or a brief phrase summarizing the reported finding.
        types:
          type: array
          items:
            type: string
          nullable: true
          description: One or more types of the reported finding.
        uid:
          type: string
          description: The unique identifier of the reported finding.
      required:
        - title
        - uid
    ocsfv1.3.0compliancefindingFingerprint:
      title: ocsfv1.3.0compliancefindingFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0compliancefindingFingerprint_AlgorithmId:
      title: ocsfv1.3.0compliancefindingFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0compliancefindingGroup:
      title: ocsfv1.3.0compliancefindingGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0compliancefindingIdp:
      title: ocsfv1.3.0compliancefindingIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0compliancefindingImage:
      title: ocsfv1.3.0compliancefindingImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0compliancefindingKbArticle:
      title: ocsfv1.3.0compliancefindingKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0compliancefindingKbArticle_InstallStateId:
      title: ocsfv1.3.0compliancefindingKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingKeyboardInfo:
      title: ocsfv1.3.0compliancefindingKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0compliancefindingKillChainPhase:
      title: ocsfv1.3.0compliancefindingKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0compliancefindingKillChainPhase_PhaseId:
      title: ocsfv1.3.0compliancefindingKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0compliancefindingLdapPerson:
      title: ocsfv1.3.0compliancefindingLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0compliancefindingLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0compliancefindingLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingLocation:
      title: ocsfv1.3.0compliancefindingLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0compliancefindingLogger:
      title: ocsfv1.3.0compliancefindingLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0compliancefindingMetadata:
      title: ocsfv1.3.0compliancefindingMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0compliancefindingMetric:
      title: ocsfv1.3.0compliancefindingMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0compliancefindingNetworkInterface:
      title: ocsfv1.3.0compliancefindingNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0compliancefindingNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0compliancefindingNetworkInterface_TypeId:
      title: ocsfv1.3.0compliancefindingNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingObject:
      title: ocsfv1.3.0compliancefindingObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0compliancefindingObservable:
      title: ocsfv1.3.0compliancefindingObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0compliancefindingObservable_TypeId:
      title: ocsfv1.3.0compliancefindingObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0compliancefindingOrganization:
      title: ocsfv1.3.0compliancefindingOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0compliancefindingOs:
      title: ocsfv1.3.0compliancefindingOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0compliancefindingOs_TypeId:
      title: ocsfv1.3.0compliancefindingOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0compliancefindingOsint:
      title: ocsfv1.3.0compliancefindingOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0compliancefindingOsint_ConfidenceId:
      title: ocsfv1.3.0compliancefindingOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingOsint_Tlp:
      title: ocsfv1.3.0compliancefindingOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0compliancefindingOsint_TypeId:
      title: ocsfv1.3.0compliancefindingOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0compliancefindingPackage:
      title: ocsfv1.3.0compliancefindingPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0compliancefindingPackage_TypeId:
      title: ocsfv1.3.0compliancefindingPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingPolicy:
      title: ocsfv1.3.0compliancefindingPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0compliancefindingProcess:
      title: ocsfv1.3.0compliancefindingProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0compliancefindingProcess_IntegrityId:
      title: ocsfv1.3.0compliancefindingProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0compliancefindingProduct:
      title: ocsfv1.3.0compliancefindingProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0compliancefindingRelatedEvent:
      title: ocsfv1.3.0compliancefindingRelatedEvent
      type: object
      description: The Related Event object describes an OCSF event related to a finding.
      properties:
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        product_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the product that reported the related
            event.
        type:
          type: string
          nullable: true
          description: >-
            The type of the related event, as defined by <code>type_uid</code>.
            <p>For example: <code>Process Activity: Launch.</code></p>
        type_name:
          type: string
          nullable: true
          description: >-
            The type of the related OCSF event, as defined by
            <code>type_uid</code>. <p>For example: <code>Process Activity:
            Launch.</code></p>
        type_uid:
          type: integer
          nullable: true
          description: >-
            The unique identifier of the related OCSF event type. <p>For
            example: <code>100701.</code></p>
        uid:
          type: string
          description: >-
            The unique identifier of the related OCSF event. This value must be
            equal to <code>metadata.uid</code> in the corresponding related
            event.
      required:
        - uid
    ocsfv1.3.0compliancefindingRemediation:
      title: ocsfv1.3.0compliancefindingRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0compliancefindingReputation:
      title: ocsfv1.3.0compliancefindingReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0compliancefindingReputation_ScoreId:
      title: ocsfv1.3.0compliancefindingReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0compliancefindingRequest:
      title: ocsfv1.3.0compliancefindingRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0compliancefindingResourceDetails:
      title: ocsfv1.3.0compliancefindingResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0compliancefindingResponse:
      title: ocsfv1.3.0compliancefindingResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0compliancefindingService:
      title: ocsfv1.3.0compliancefindingService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0compliancefindingSession:
      title: ocsfv1.3.0compliancefindingSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0compliancefindingSubTechnique:
      title: ocsfv1.3.0compliancefindingSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0compliancefindingTactic:
      title: ocsfv1.3.0compliancefindingTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0compliancefindingTechnique:
      title: ocsfv1.3.0compliancefindingTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0compliancefindingTimespan:
      title: ocsfv1.3.0compliancefindingTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0compliancefindingTimespan_TypeId:
      title: ocsfv1.3.0compliancefindingTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingUrl:
      title: ocsfv1.3.0compliancefindingUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0compliancefindingUrl_CategoryIds:
      title: ocsfv1.3.0compliancefindingUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0compliancefindingUser:
      title: ocsfv1.3.0compliancefindingUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0compliancefindingUser_MfaStatusId:
      title: ocsfv1.3.0compliancefindingUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingUser_RiskLevelId:
      title: ocsfv1.3.0compliancefindingUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0compliancefindingUser_TypeId:
      title: ocsfv1.3.0compliancefindingUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0compliancefindingUser_UserStatusId:
      title: ocsfv1.3.0compliancefindingUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0compliancefindingVulnerability:
      title: ocsfv1.3.0compliancefindingVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0compliancefindingWhois:
      title: ocsfv1.3.0compliancefindingWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0compliancefindingDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0compliancefindingSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0compliancefindingWhois_DnssecStatusId:
      title: ocsfv1.3.0compliancefindingWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateEmailAddress:
      title: ocsfv1.3.0configstateEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0configstateFileName:
      title: ocsfv1.3.0configstateFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0configstateHash:
      title: ocsfv1.3.0configstateHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0configstateHostname:
      title: ocsfv1.3.0configstateHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0configstateIPAddress:
      title: ocsfv1.3.0configstateIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0configstateMACAddress:
      title: ocsfv1.3.0configstateMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0configstatePort:
      title: ocsfv1.3.0configstatePort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0configstateProcessName:
      title: ocsfv1.3.0configstateProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0configstateSubnet:
      title: ocsfv1.3.0configstateSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0configstateTimestamp:
      title: ocsfv1.3.0configstateTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0configstateURLString:
      title: ocsfv1.3.0configstateURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0configstateUserName:
      title: ocsfv1.3.0configstateUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0configstateActivityId:
      title: ocsfv1.3.0configstateActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Log: The discovered information is via a log.

        2 - Collect: The discovered information is via a collection process.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateCategoryUid:
      title: ocsfv1.3.0configstateCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        5 - Discovery: Discovery events report the existence and state of
        devices, files, configurations, processes, registry keys, and other
        objects.
    ocsfv1.3.0configstateClassUid:
      title: ocsfv1.3.0configstateClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        5002 - DeviceConfigState: Device Config State events report device
        configuration data and CIS Benchmark results.
    ocsfv1.3.0configstateConfigState:
      title: ocsfv1.3.0configstateConfigState
      type: object
      description: >-
        Device Config State events report device configuration data and CIS
        Benchmark results.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0configstateActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0configstateApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Discovery</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCategoryUid'
          description: The category unique identifier of the event.
        cis_benchmark_result:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCisBenchmarkResult'
          nullable: true
          description: The CIS benchmark result.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0configstateClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDevice'
          description: The device that is being discovered by an inventory process.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0configstateMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - device
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0configstateSeverityId:
      title: ocsfv1.3.0configstateSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0configstateStatusId:
      title: ocsfv1.3.0configstateStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0configstateTypeUid:
      title: ocsfv1.3.0configstateTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        500200 - Unknown

        500201 - Log: The discovered information is via a log.

        500202 - Collect: The discovered information is via a collection
        process.

        500299 - Other
    ocsfv1.3.0configstateAccount:
      title: ocsfv1.3.0configstateAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0configstateAccount_TypeId:
      title: ocsfv1.3.0configstateAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0configstateActor:
      title: ocsfv1.3.0configstateActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0configstateIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0configstateSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0configstateActor_ActorTypeId:
      title: ocsfv1.3.0configstateActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateAffectedCode:
      title: ocsfv1.3.0configstateAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0configstateRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0configstateAffectedPackage:
      title: ocsfv1.3.0configstateAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0configstateRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0configstateAffectedPackage_TypeId:
      title: ocsfv1.3.0configstateAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateAgent:
      title: ocsfv1.3.0configstateAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0configstateAgent_TypeId:
      title: ocsfv1.3.0configstateAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateApi:
      title: ocsfv1.3.0configstateApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0configstateGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0configstateRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0configstateResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0configstateService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0configstateAttack:
      title: ocsfv1.3.0configstateAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0configstateSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0configstateAuthorization:
      title: ocsfv1.3.0configstateAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0configstatePolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0configstateAutonomousSystem:
      title: ocsfv1.3.0configstateAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0configstateCertificate:
      title: ocsfv1.3.0configstateCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0configstateCisBenchmarkResult:
      title: ocsfv1.3.0configstateCisBenchmarkResult
      type: object
      description: >-
        The CIS Benchmark Result object contains information as defined by the
        Center for Internet Security (<a target="_blank"
        href="https://www.cisecurity.org/cis-benchmarks/">CIS</a>) benchmark
        result. CIS Benchmarks are a collection of best practices for securely
        configuring IT systems, software, networks, and cloud infrastructure.
      properties:
        desc:
          type: string
          nullable: true
          description: The CIS benchmark description.
        name:
          type: string
          description: The CIS benchmark name.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0configstateRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        rule:
          $ref: '#/components/schemas/ocsfv1.3.0configstateRule'
          nullable: true
          description: The CIS benchmark rule.
      required:
        - name
    ocsfv1.3.0configstateCloud:
      title: ocsfv1.3.0configstateCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0configstateContainer:
      title: ocsfv1.3.0configstateContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0configstateImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0configstateCve:
      title: ocsfv1.3.0configstateCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0configstateCvss:
      title: ocsfv1.3.0configstateCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0configstateCvss_Depth:
      title: ocsfv1.3.0configstateCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0configstateCwe:
      title: ocsfv1.3.0configstateCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0configstateDevice:
      title: ocsfv1.3.0configstateDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0configstateContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0configstateHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0configstateImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0configstateIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0configstateLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0configstateMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0configstateSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0configstateDevice_NetworkStatusId:
      title: ocsfv1.3.0configstateDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0configstateDevice_RiskLevelId:
      title: ocsfv1.3.0configstateDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0configstateDevice_TypeId:
      title: ocsfv1.3.0configstateDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0configstateDeviceHwInfo:
      title: ocsfv1.3.0configstateDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0configstateKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0configstateDigitalSignature:
      title: ocsfv1.3.0configstateDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0configstateDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0configstateDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0configstateDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0configstateDigitalSignature_StateId:
      title: ocsfv1.3.0configstateDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0configstateDisplay:
      title: ocsfv1.3.0configstateDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0configstateDnsAnswer:
      title: ocsfv1.3.0configstateDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0configstateDnsAnswer_FlagIds:
      title: ocsfv1.3.0configstateDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0configstateDomainContact:
      title: ocsfv1.3.0configstateDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0configstateLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0configstateDomainContact_TypeId:
      title: ocsfv1.3.0configstateDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateEmail:
      title: ocsfv1.3.0configstateEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0configstateEmailAuth:
      title: ocsfv1.3.0configstateEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0configstateEnrichment:
      title: ocsfv1.3.0configstateEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0configstateReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0configstateEpss:
      title: ocsfv1.3.0configstateEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0configstateExtension:
      title: ocsfv1.3.0configstateExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0configstateFeature:
      title: ocsfv1.3.0configstateFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0configstateFile:
      title: ocsfv1.3.0configstateFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0configstateFile_ConfidentialityId:
      title: ocsfv1.3.0configstateFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateFile_TypeId:
      title: ocsfv1.3.0configstateFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateFingerprint:
      title: ocsfv1.3.0configstateFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0configstateHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0configstateFingerprint_AlgorithmId:
      title: ocsfv1.3.0configstateFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0configstateGroup:
      title: ocsfv1.3.0configstateGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0configstateIdp:
      title: ocsfv1.3.0configstateIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0configstateImage:
      title: ocsfv1.3.0configstateImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0configstateKbArticle:
      title: ocsfv1.3.0configstateKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0configstateKbArticle_InstallStateId:
      title: ocsfv1.3.0configstateKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateKeyboardInfo:
      title: ocsfv1.3.0configstateKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0configstateKillChainPhase:
      title: ocsfv1.3.0configstateKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0configstateKillChainPhase_PhaseId:
      title: ocsfv1.3.0configstateKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0configstateLdapPerson:
      title: ocsfv1.3.0configstateLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0configstateLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0configstateLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0configstateLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0configstateLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateLocation:
      title: ocsfv1.3.0configstateLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0configstateLogger:
      title: ocsfv1.3.0configstateLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0configstateDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0configstateMetadata:
      title: ocsfv1.3.0configstateMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0configstateExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0configstateMetric:
      title: ocsfv1.3.0configstateMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0configstateNetworkInterface:
      title: ocsfv1.3.0configstateNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0configstateHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0configstateIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0configstateMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0configstateNetworkInterface_TypeId:
      title: ocsfv1.3.0configstateNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateObject:
      title: ocsfv1.3.0configstateObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0configstateObservable:
      title: ocsfv1.3.0configstateObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0configstateReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0configstateObservable_TypeId:
      title: ocsfv1.3.0configstateObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0configstateOrganization:
      title: ocsfv1.3.0configstateOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0configstateOs:
      title: ocsfv1.3.0configstateOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0configstateOs_TypeId:
      title: ocsfv1.3.0configstateOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0configstateOsint:
      title: ocsfv1.3.0configstateOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0configstateLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0configstateWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0configstateOsint_ConfidenceId:
      title: ocsfv1.3.0configstateOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateOsint_Tlp:
      title: ocsfv1.3.0configstateOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0configstateOsint_TypeId:
      title: ocsfv1.3.0configstateOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0configstatePackage:
      title: ocsfv1.3.0configstatePackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstatePackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0configstatePackage_TypeId:
      title: ocsfv1.3.0configstatePackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstatePolicy:
      title: ocsfv1.3.0configstatePolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0configstateGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0configstateProcess:
      title: ocsfv1.3.0configstateProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0configstateContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0configstateGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0configstateProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0configstateSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0configstateObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0configstateProcess_IntegrityId:
      title: ocsfv1.3.0configstateProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0configstateProduct:
      title: ocsfv1.3.0configstateProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0configstateFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0configstateRemediation:
      title: ocsfv1.3.0configstateRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0configstateReputation:
      title: ocsfv1.3.0configstateReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0configstateReputation_ScoreId:
      title: ocsfv1.3.0configstateReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0configstateRequest:
      title: ocsfv1.3.0configstateRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0configstateResponse:
      title: ocsfv1.3.0configstateResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0configstateRule:
      title: ocsfv1.3.0configstateRule
      type: object
      description: >-
        The Rule object describes characteristics of a rule associated with a
        policy or an event.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0configstateService:
      title: ocsfv1.3.0configstateService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0configstateSession:
      title: ocsfv1.3.0configstateSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0configstateSubTechnique:
      title: ocsfv1.3.0configstateSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0configstateTactic:
      title: ocsfv1.3.0configstateTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0configstateTechnique:
      title: ocsfv1.3.0configstateTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0configstateTimespan:
      title: ocsfv1.3.0configstateTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0configstateTimespan_TypeId:
      title: ocsfv1.3.0configstateTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateUrl:
      title: ocsfv1.3.0configstateUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0configstateHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0configstatePort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0configstateURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0configstateUrl_CategoryIds:
      title: ocsfv1.3.0configstateUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0configstateUser:
      title: ocsfv1.3.0configstateUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0configstateLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0configstateOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0configstateUser_MfaStatusId:
      title: ocsfv1.3.0configstateUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateUser_RiskLevelId:
      title: ocsfv1.3.0configstateUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0configstateUser_TypeId:
      title: ocsfv1.3.0configstateUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0configstateUser_UserStatusId:
      title: ocsfv1.3.0configstateUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0configstateVulnerability:
      title: ocsfv1.3.0configstateVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0configstateCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstatePackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0configstateRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0configstateWhois:
      title: ocsfv1.3.0configstateWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0configstateAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0configstateWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0configstateDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0configstateEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0configstateTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0configstateSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0configstateWhois_DnssecStatusId:
      title: ocsfv1.3.0configstateWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingEmailAddress:
      title: ocsfv1.3.0detectionfindingEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0detectionfindingFileName:
      title: ocsfv1.3.0detectionfindingFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0detectionfindingHash:
      title: ocsfv1.3.0detectionfindingHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0detectionfindingHostname:
      title: ocsfv1.3.0detectionfindingHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0detectionfindingIPAddress:
      title: ocsfv1.3.0detectionfindingIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0detectionfindingMACAddress:
      title: ocsfv1.3.0detectionfindingMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0detectionfindingPort:
      title: ocsfv1.3.0detectionfindingPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0detectionfindingProcessName:
      title: ocsfv1.3.0detectionfindingProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0detectionfindingSubnet:
      title: ocsfv1.3.0detectionfindingSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0detectionfindingTimestamp:
      title: ocsfv1.3.0detectionfindingTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0detectionfindingURLString:
      title: ocsfv1.3.0detectionfindingURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0detectionfindingUserName:
      title: ocsfv1.3.0detectionfindingUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0detectionfindingActionId:
      title: ocsfv1.3.0detectionfindingActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingActivityId:
      title: ocsfv1.3.0detectionfindingActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A finding was created.

        2 - Update: A finding was updated.

        3 - Close: A finding was closed.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingCategoryUid:
      title: ocsfv1.3.0detectionfindingCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        2 - Findings: Findings events report findings, detections, and possible
        resolutions of malware, anomalies, or other actions performed by
        security products.
    ocsfv1.3.0detectionfindingClassUid:
      title: ocsfv1.3.0detectionfindingClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        2004 - DetectionFinding: A Detection Finding describes detections or
        alerts generated by security products using correlation engines,
        detection engines or other methodologies. Note: if the product is a
        security control, the <code>security_control</code> profile should be
        applied and its <code>attacks</code> information should be duplicated
        into the <code>finding_info</code> object.
    ocsfv1.3.0detectionfindingConfidenceId:
      title: ocsfv1.3.0detectionfindingConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingDetectionFinding:
      title: ocsfv1.3.0detectionfindingDetectionFinding
      type: object
      description: >-
        A Detection Finding describes detections or alerts generated by security
        products using correlation engines, detection engines or other
        methodologies. Note: if the product is a security control, the
        <code>security_control</code> profile should be applied and its
        <code>attacks</code> information should be duplicated into the
        <code>finding_info</code> object.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingActivityId'
          description: The normalized identifier of the finding activity.
        activity_name:
          type: string
          nullable: true
          description: >-
            The finding activity name, as defined by the
            <code>activity_id</code>.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Findings</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        comment:
          type: string
          nullable: true
          description: A user provided comment about the finding.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDevice'
          nullable: true
          description: >-
            Describes the affected device/host. It can be used in conjunction
            with <code>Affected Resource(s)</code>. <p> e.g. Specific details
            about an AWS EC2 instance, that is affected by the Finding.</p>
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time of the most recent event included in the finding.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the most recent event included in the finding.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        evidences:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEvidences'
          nullable: true
          description: >-
            Describes various evidence artifacts associated to the
            activity/activities that triggered a security detection.
        finding_info:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFindingInfo'
          description: Describes the supporting information about a generated finding.
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        impact:
          type: string
          nullable: true
          description: >-
            The impact , normalized to the caption of the impact_id value. In
            the case of 'Other', it is defined by the event source.
        impact_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingImpactId'
          nullable: true
          description: The normalized impact of the finding.
        impact_score:
          type: integer
          nullable: true
          description: The impact of the finding, valid range 0-100.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingResourceDetails'
          nullable: true
          description: >-
            Describes details about resources that were the target of the
            activity that triggered the finding.
        risk_details:
          type: string
          nullable: true
          description: Describes the risk associated with the finding.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time of the least recent event included in the finding.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the least recent event included in the finding.
        status:
          type: string
          nullable: true
          description: >-
            The normalized status of the Finding set by the consumer normalized
            to the caption of the status_id value. In the case of 'Other', it is
            defined by the source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingStatusId'
          nullable: true
          description: >-
            The normalized status identifier of the Finding, set by the
            consumer.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingVulnerability'
          nullable: true
          description: Describes vulnerabilities reported in a Detection Finding.
      required:
        - activity_id
        - category_uid
        - class_uid
        - finding_info
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0detectionfindingDispositionId:
      title: ocsfv1.3.0detectionfindingDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingImpactId:
      title: ocsfv1.3.0detectionfindingImpactId
      type: integer
      description: >-
        ImpactId is an enum, and the following values are allowed.

        0 - Unknown: The normalized impact is unknown.

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The impact is not mapped. See the <code>impact</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingRiskLevelId:
      title: ocsfv1.3.0detectionfindingRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingSeverityId:
      title: ocsfv1.3.0detectionfindingSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingStatusId:
      title: ocsfv1.3.0detectionfindingStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - New: The Finding is new and yet to be reviewed.

        2 - InProgress: The Finding is under review.

        3 - Suppressed: The Finding was reviewed, determined to be benign or a
        false positive and is now suppressed.

        4 - Resolved: The Finding was reviewed, remediated and is now considered
        resolved.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingTypeUid:
      title: ocsfv1.3.0detectionfindingTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        200400 - Unknown
        200401 - Create: A finding was created.
        200402 - Update: A finding was updated.
        200403 - Close: A finding was closed.
        200499 - Other
    ocsfv1.3.0detectionfindingAccount:
      title: ocsfv1.3.0detectionfindingAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0detectionfindingAccount_TypeId:
      title: ocsfv1.3.0detectionfindingAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0detectionfindingActor:
      title: ocsfv1.3.0detectionfindingActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0detectionfindingActor_ActorTypeId:
      title: ocsfv1.3.0detectionfindingActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingAffectedCode:
      title: ocsfv1.3.0detectionfindingAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0detectionfindingAffectedPackage:
      title: ocsfv1.3.0detectionfindingAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0detectionfindingAffectedPackage_TypeId:
      title: ocsfv1.3.0detectionfindingAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingAgent:
      title: ocsfv1.3.0detectionfindingAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0detectionfindingAgent_TypeId:
      title: ocsfv1.3.0detectionfindingAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingAnalytic:
      title: ocsfv1.3.0detectionfindingAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.3.0detectionfindingAnalytic_TypeId:
      title: ocsfv1.3.0detectionfindingAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingApi:
      title: ocsfv1.3.0detectionfindingApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0detectionfindingAttack:
      title: ocsfv1.3.0detectionfindingAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0detectionfindingAuthorization:
      title: ocsfv1.3.0detectionfindingAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0detectionfindingAutonomousSystem:
      title: ocsfv1.3.0detectionfindingAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0detectionfindingCertificate:
      title: ocsfv1.3.0detectionfindingCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0detectionfindingCloud:
      title: ocsfv1.3.0detectionfindingCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0detectionfindingContainer:
      title: ocsfv1.3.0detectionfindingContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0detectionfindingCve:
      title: ocsfv1.3.0detectionfindingCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0detectionfindingCvss:
      title: ocsfv1.3.0detectionfindingCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0detectionfindingCvss_Depth:
      title: ocsfv1.3.0detectionfindingCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0detectionfindingCwe:
      title: ocsfv1.3.0detectionfindingCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0detectionfindingDatabase:
      title: ocsfv1.3.0detectionfindingDatabase
      type: object
      description: >-
        The database object is used for databases which are typically datastore
        services that contain an organized collection of structured and
        unstructured data or a types of data.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the database was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the database was known to have been created.
        desc:
          type: string
          nullable: true
          description: The description of the database.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The group names to which the database belongs.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the database.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the database.
        name:
          type: string
          nullable: true
          description: >-
            The database name, ordinarily as assigned by a database
            administrator.
        size:
          type: integer
          nullable: true
          description: The size of the database in bytes.
        type:
          type: string
          nullable: true
          description: The database type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDatabase_TypeId'
          description: The normalized identifier of the database type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the database.
      required:
        - type_id
    ocsfv1.3.0detectionfindingDatabase_TypeId:
      title: ocsfv1.3.0detectionfindingDatabase_TypeId
      type: integer
      description: >-
        DatabaseTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Relational

        2 - Network

        3 - ObjectOriented

        4 - Centralized

        5 - Operational

        6 - NoSQL

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingDatabucket:
      title: ocsfv1.3.0detectionfindingDatabucket
      type: object
      description: >-
        The databucket object is a basic container that holds data, typically
        organized through the use of data partitions.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the databucket was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the databucket was known to have been created.
        desc:
          type: string
          nullable: true
          description: The description of the databucket.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile'
          nullable: true
          description: A file within a databucket.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The group names to which the databucket belongs.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the databucket.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the databucket.
        name:
          type: string
          nullable: true
          description: The databucket name.
        size:
          type: integer
          nullable: true
          description: The size of the databucket in bytes.
        type:
          type: string
          nullable: true
          description: The databucket type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDatabucket_TypeId'
          description: The normalized identifier of the databucket type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the databucket.
      required:
        - type_id
    ocsfv1.3.0detectionfindingDatabucket_TypeId:
      title: ocsfv1.3.0detectionfindingDatabucket_TypeId
      type: integer
      description: >-
        DatabucketTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - S3

        2 - AzureBlob

        3 - GCPBucket

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingDevice:
      title: ocsfv1.3.0detectionfindingDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0detectionfindingDevice_NetworkStatusId:
      title: ocsfv1.3.0detectionfindingDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0detectionfindingDevice_RiskLevelId:
      title: ocsfv1.3.0detectionfindingDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingDevice_TypeId:
      title: ocsfv1.3.0detectionfindingDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0detectionfindingDeviceHwInfo:
      title: ocsfv1.3.0detectionfindingDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0detectionfindingDigitalSignature:
      title: ocsfv1.3.0detectionfindingDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0detectionfindingDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0detectionfindingDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingDigitalSignature_StateId:
      title: ocsfv1.3.0detectionfindingDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingDisplay:
      title: ocsfv1.3.0detectionfindingDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0detectionfindingDnsAnswer:
      title: ocsfv1.3.0detectionfindingDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0detectionfindingDnsAnswer_FlagIds:
      title: ocsfv1.3.0detectionfindingDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingDnsQuery:
      title: ocsfv1.3.0detectionfindingDnsQuery
      type: object
      description: >-
        The DNS query object represents a specific request made to the Domain
        Name System (DNS) to retrieve information about a domain or perform a
        DNS operation. This object encapsulates the necessary attributes and
        methods to construct and send DNS queries, specify the query type (e.g.,
        A, AAAA, MX). Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DNSLookup/">d3f:DNSLookup</a>.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of resource records being queried. See <a target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHostname'
          description: >-
            The hostname or domain being queried. For example:
            <code>www.example.com</code>
        opcode:
          type: string
          nullable: true
          description: The DNS opcode specifies the type of the query message.
        opcode_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDnsQuery_OpcodeId'
          nullable: true
          description: >-
            The DNS opcode ID specifies the normalized query message type as
            defined in <a target='_blank'
            href='https://www.rfc-editor.org/rfc/rfc5395.html'>RFC-5395</a>.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        type:
          type: string
          nullable: true
          description: >-
            The type of resource records being queried. See <a target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: A, AAAA, CNAME, MX, and NS.
      required:
        - hostname
    ocsfv1.3.0detectionfindingDnsQuery_OpcodeId:
      title: ocsfv1.3.0detectionfindingDnsQuery_OpcodeId
      type: integer
      description: >-
        DnsQueryOpcodeId is an enum, and the following values are allowed.

        0 - Query: Standard query

        1 - InverseQuery: Inverse query, obsolete

        2 - Status: Server status request

        3 - Reserved: Reserved, not used

        4 - Notify: Zone change notification

        5 - Update: Dynamic DNS update

        6 - DSOMessage: DNS Stateful Operations (DSO)

        99 - Other: The DNS Opcode is not defined by the RFC. See the
        <code>opcode</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingDomainContact:
      title: ocsfv1.3.0detectionfindingDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0detectionfindingDomainContact_TypeId:
      title: ocsfv1.3.0detectionfindingDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingEmail:
      title: ocsfv1.3.0detectionfindingEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0detectionfindingEmailAuth:
      title: ocsfv1.3.0detectionfindingEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0detectionfindingEnrichment:
      title: ocsfv1.3.0detectionfindingEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0detectionfindingEpss:
      title: ocsfv1.3.0detectionfindingEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0detectionfindingEvidences:
      title: ocsfv1.3.0detectionfindingEvidences
      type: object
      description: >-
        A collection of evidence artifacts associated to the activity/activities
        that triggered a security detection.
      properties:
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingActor'
          nullable: true
          description: >-
            Describes details about the user/role/process that was the source of
            the activity that triggered the detection.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingApi'
          nullable: true
          description: >-
            Describes details about the API call associated to the activity that
            triggered the detection.
        connection_info:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingNetworkConnectionInfo'
          nullable: true
          description: >-
            Describes details about the network connection associated to the
            activity that triggered the detection.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            Describes details about the container associated to the activity
            that triggered the detection.
        data:
          nullable: true
          description: >-
            Additional evidence data that is not accounted for in the specific
            evidence attributes.<code> Use only when absolutely
            necessary.</code>
        database:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDatabase'
          nullable: true
          description: >-
            Describes details about the database associated to the activity that
            triggered the detection.
        databucket:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDatabucket'
          nullable: true
          description: >-
            Describes details about the databucket associated to the activity
            that triggered the detection.
        device:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDevice'
          nullable: true
          description: >-
            An addressable device, computer system or host associated to the
            activity that triggered the detection.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingNetworkEndpoint'
          nullable: true
          description: >-
            Describes details about the destination of the network activity that
            triggered the detection.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmail'
          nullable: true
          description: >-
            The email object associated to the activity that triggered the
            detection.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile'
          nullable: true
          description: >-
            Describes details about the file associated to the activity that
            triggered the detection.
        job:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingJob'
          nullable: true
          description: >-
            Describes details about the scheduled job that was associated with
            the activity that triggered the detection.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProcess'
          nullable: true
          description: >-
            Describes details about the process associated to the activity that
            triggered the detection.
        query:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDnsQuery'
          nullable: true
          description: >-
            Describes details about the DNS query associated to the activity
            that triggered the detection.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingNetworkEndpoint'
          nullable: true
          description: >-
            Describes details about the source of the network activity that
            triggered the detection.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object associated to
            the activity that triggered the detection.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: >-
            Describes details about the user that was the target or somehow else
            associated with the activity that triggered the detection.
    ocsfv1.3.0detectionfindingExtension:
      title: ocsfv1.3.0detectionfindingExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0detectionfindingFeature:
      title: ocsfv1.3.0detectionfindingFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0detectionfindingFile:
      title: ocsfv1.3.0detectionfindingFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0detectionfindingFile_ConfidentialityId:
      title: ocsfv1.3.0detectionfindingFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingFile_TypeId:
      title: ocsfv1.3.0detectionfindingFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingFindingInfo:
      title: ocsfv1.3.0detectionfindingFindingInfo
      type: object
      description: >-
        The Finding Information object describes metadata related to a security
        finding generated by a security tool or system.
      properties:
        analytic:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAnalytic'
          nullable: true
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAttack'
          nullable: true
          description: >-
            The <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> technique and associated tactics related to the
            finding.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was created.
        data_sources:
          type: array
          items:
            type: string
          nullable: true
          description: A list of data sources utilized in generation of the finding.
        desc:
          type: string
          nullable: true
          description: The description of the reported finding.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was last modified.
        product_uid:
          type: string
          nullable: true
          description: The unique identifier of the product that reported the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAnalytic'
          nullable: true
          description: Other analytics related to this finding.
        related_events:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRelatedEvent'
          nullable: true
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: The URL pointing to the source of the finding.
        title:
          type: string
          description: A title or a brief phrase summarizing the reported finding.
        types:
          type: array
          items:
            type: string
          nullable: true
          description: One or more types of the reported finding.
        uid:
          type: string
          description: The unique identifier of the reported finding.
      required:
        - title
        - uid
    ocsfv1.3.0detectionfindingFingerprint:
      title: ocsfv1.3.0detectionfindingFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0detectionfindingFingerprint_AlgorithmId:
      title: ocsfv1.3.0detectionfindingFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingFirewallRule:
      title: ocsfv1.3.0detectionfindingFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0detectionfindingGroup:
      title: ocsfv1.3.0detectionfindingGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0detectionfindingIdp:
      title: ocsfv1.3.0detectionfindingIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0detectionfindingImage:
      title: ocsfv1.3.0detectionfindingImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0detectionfindingJob:
      title: ocsfv1.3.0detectionfindingJob
      type: object
      description: >-
        The Job object provides information about a scheduled job or task,
        including its name, command line, and state. It encompasses attributes
        that describe the properties and status of the scheduled job.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: The job command line.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the job was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the job was created.
        desc:
          type: string
          nullable: true
          description: The description of the job.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile'
          description: The file that pertains to the job.
        last_run_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the job was last run.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the job was last run.
        name:
          type: string
          description: The name of the job.
        next_run_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the job will next be run.
        next_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the job will next be run.
        run_state:
          type: string
          nullable: true
          description: The run state of the job.
        run_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingJob_RunStateId'
          nullable: true
          description: The run state ID of the job.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The user that created the job.
      required:
        - file
        - name
    ocsfv1.3.0detectionfindingJob_RunStateId:
      title: ocsfv1.3.0detectionfindingJob_RunStateId
      type: integer
      description: >-
        JobRunStateId is an enum, and the following values are allowed.

        0 - Unknown: The run state is unknown.

        1 - Ready

        2 - Queued

        3 - Running

        4 - Stopped

        99 - Other: The run state is not mapped. See the <code>run_state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingKbArticle:
      title: ocsfv1.3.0detectionfindingKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0detectionfindingKbArticle_InstallStateId:
      title: ocsfv1.3.0detectionfindingKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingKeyboardInfo:
      title: ocsfv1.3.0detectionfindingKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0detectionfindingKillChainPhase:
      title: ocsfv1.3.0detectionfindingKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0detectionfindingKillChainPhase_PhaseId:
      title: ocsfv1.3.0detectionfindingKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingLdapPerson:
      title: ocsfv1.3.0detectionfindingLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0detectionfindingLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0detectionfindingLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingLocation:
      title: ocsfv1.3.0detectionfindingLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0detectionfindingLogger:
      title: ocsfv1.3.0detectionfindingLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0detectionfindingMalware:
      title: ocsfv1.3.0detectionfindingMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0detectionfindingMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0detectionfindingMalware_ClassificationIds:
      title: ocsfv1.3.0detectionfindingMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingMetadata:
      title: ocsfv1.3.0detectionfindingMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0detectionfindingMetric:
      title: ocsfv1.3.0detectionfindingMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0detectionfindingNetworkConnectionInfo:
      title: ocsfv1.3.0detectionfindingNetworkConnectionInfo
      type: object
      description: >-
        The Network Connection Information object describes characteristics of a
        network connection. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/">d3f:NetworkSession</a>.
      properties:
        boundary:
          type: string
          nullable: true
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'. In the case of 'Other', it is defined by the event
            source. <p> For cloud connections, this translates to the
            traffic-boundary(same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        boundary_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingNetworkConnectionInfo_BoundaryId
          nullable: true
          description: >-
            <p>The normalized identifier of the boundary of the connection.
            </p><p> For cloud connections, this translates to the
            traffic-boundary (same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the initiated connection, traffic, or email,
            normalized to the caption of the direction_id value. In the case of
            'Other', it is defined by the event source.
        direction_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingNetworkConnectionInfo_DirectionId
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The TCP/IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>tcp</code> or <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The TCP/IP protocol number, as defined by the Internet Assigned
            Numbers Authority (IANA). Use -1 if the protocol is not defined by
            IANA. See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>6</code> for TCP and <code>17</code>
            for UDP.
        protocol_ver:
          type: string
          nullable: true
          description: The Internet Protocol version.
        protocol_ver_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingNetworkConnectionInfo_ProtocolVerId
          nullable: true
          description: The Internet Protocol version identifier.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSession'
          nullable: true
          description: The authenticated user or service session.
        tcp_flags:
          type: integer
          nullable: true
          description: The network connection TCP header flags (i.e., control bits).
        uid:
          type: string
          nullable: true
          description: The unique identifier of the connection.
      required:
        - direction_id
    ocsfv1.3.0detectionfindingNetworkConnectionInfo_BoundaryId:
      title: ocsfv1.3.0detectionfindingNetworkConnectionInfo_BoundaryId
      type: integer
      description: >-
        NetworkConnectionInfoBoundaryId is an enum, and the following values are
        allowed.

        0 - Unknown: The connection boundary is unknown.

        1 - Localhost: Local network traffic on the same endpoint.

        2 - Internal: Internal network traffic between two endpoints inside
        network.

        3 - External: External network traffic between two endpoints on the
        Internet or outside the network.

        4 - SameVPC: Through another resource in the same VPC

        5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint

        6 - VirtualPrivateGateway: Through a virtual private gateway

        7 - regionVPC: Through an intra-region VPC peering connection

        8 - regionVPC: Through an inter-region VPC peering connection

        9 - LocalGateway: Through a local gateway

        10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances
        only)

        11 - InternetGateway: Through an Internet gateway (Nitro-based instances
        only)

        99 - Other: The boundary is not mapped. See the <code>boundary</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingNetworkConnectionInfo_DirectionId:
      title: ocsfv1.3.0detectionfindingNetworkConnectionInfo_DirectionId
      type: integer
      description: >-
        NetworkConnectionInfoDirectionId is an enum, and the following values
        are allowed.

        0 - Unknown: The connection direction is unknown.

        1 - Inbound: Inbound network connection. The connection was originated
        from the Internet or outside network, destined for services on the
        inside network.

        2 - Outbound: Outbound network connection. The connection was originated
        from inside the network, destined for services on the Internet or
        outside network.

        3 - Lateral: Lateral network connection. The connection was originated
        from inside the network, destined for services on the inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0detectionfindingNetworkConnectionInfo_ProtocolVerId:
      title: ocsfv1.3.0detectionfindingNetworkConnectionInfo_ProtocolVerId
      type: integer
      description: >-
        NetworkConnectionInfoProtocolVerId is an enum, and the following values
        are allowed.

        0 - Unknown: The protocol version is unknown.

        4 - IPv4*

        6 - IPv6*

        99 - Other: The protocol version is not mapped. See the
        <code>protocol_ver</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingNetworkEndpoint:
      title: ocsfv1.3.0detectionfindingNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingNetworkEndpoint_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0detectionfindingNetworkEndpoint_TypeId:
      title: ocsfv1.3.0detectionfindingNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0detectionfindingNetworkInterface:
      title: ocsfv1.3.0detectionfindingNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0detectionfindingNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0detectionfindingNetworkInterface_TypeId:
      title: ocsfv1.3.0detectionfindingNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingNetworkProxy:
      title: ocsfv1.3.0detectionfindingNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0detectionfindingNetworkProxy_TypeId:
      title: ocsfv1.3.0detectionfindingNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0detectionfindingObject:
      title: ocsfv1.3.0detectionfindingObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0detectionfindingObservable:
      title: ocsfv1.3.0detectionfindingObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0detectionfindingObservable_TypeId:
      title: ocsfv1.3.0detectionfindingObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0detectionfindingOrganization:
      title: ocsfv1.3.0detectionfindingOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0detectionfindingOs:
      title: ocsfv1.3.0detectionfindingOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0detectionfindingOs_TypeId:
      title: ocsfv1.3.0detectionfindingOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0detectionfindingOsint:
      title: ocsfv1.3.0detectionfindingOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0detectionfindingOsint_ConfidenceId:
      title: ocsfv1.3.0detectionfindingOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingOsint_Tlp:
      title: ocsfv1.3.0detectionfindingOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0detectionfindingOsint_TypeId:
      title: ocsfv1.3.0detectionfindingOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0detectionfindingPackage:
      title: ocsfv1.3.0detectionfindingPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0detectionfindingPackage_TypeId:
      title: ocsfv1.3.0detectionfindingPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingPolicy:
      title: ocsfv1.3.0detectionfindingPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0detectionfindingProcess:
      title: ocsfv1.3.0detectionfindingProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0detectionfindingProcess_IntegrityId:
      title: ocsfv1.3.0detectionfindingProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingProduct:
      title: ocsfv1.3.0detectionfindingProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0detectionfindingRelatedEvent:
      title: ocsfv1.3.0detectionfindingRelatedEvent
      type: object
      description: The Related Event object describes an OCSF event related to a finding.
      properties:
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        product_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the product that reported the related
            event.
        type:
          type: string
          nullable: true
          description: >-
            The type of the related event, as defined by <code>type_uid</code>.
            <p>For example: <code>Process Activity: Launch.</code></p>
        type_name:
          type: string
          nullable: true
          description: >-
            The type of the related OCSF event, as defined by
            <code>type_uid</code>. <p>For example: <code>Process Activity:
            Launch.</code></p>
        type_uid:
          type: integer
          nullable: true
          description: >-
            The unique identifier of the related OCSF event type. <p>For
            example: <code>100701.</code></p>
        uid:
          type: string
          description: >-
            The unique identifier of the related OCSF event. This value must be
            equal to <code>metadata.uid</code> in the corresponding related
            event.
      required:
        - uid
    ocsfv1.3.0detectionfindingRemediation:
      title: ocsfv1.3.0detectionfindingRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0detectionfindingReputation:
      title: ocsfv1.3.0detectionfindingReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0detectionfindingReputation_ScoreId:
      title: ocsfv1.3.0detectionfindingReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingRequest:
      title: ocsfv1.3.0detectionfindingRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0detectionfindingResourceDetails:
      title: ocsfv1.3.0detectionfindingResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0detectionfindingResponse:
      title: ocsfv1.3.0detectionfindingResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0detectionfindingService:
      title: ocsfv1.3.0detectionfindingService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0detectionfindingSession:
      title: ocsfv1.3.0detectionfindingSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0detectionfindingSubTechnique:
      title: ocsfv1.3.0detectionfindingSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0detectionfindingTactic:
      title: ocsfv1.3.0detectionfindingTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0detectionfindingTechnique:
      title: ocsfv1.3.0detectionfindingTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0detectionfindingTimespan:
      title: ocsfv1.3.0detectionfindingTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0detectionfindingTimespan_TypeId:
      title: ocsfv1.3.0detectionfindingTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingUrl:
      title: ocsfv1.3.0detectionfindingUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0detectionfindingUrl_CategoryIds:
      title: ocsfv1.3.0detectionfindingUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0detectionfindingUser:
      title: ocsfv1.3.0detectionfindingUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0detectionfindingUser_MfaStatusId:
      title: ocsfv1.3.0detectionfindingUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingUser_RiskLevelId:
      title: ocsfv1.3.0detectionfindingUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0detectionfindingUser_TypeId:
      title: ocsfv1.3.0detectionfindingUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0detectionfindingUser_UserStatusId:
      title: ocsfv1.3.0detectionfindingUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0detectionfindingVulnerability:
      title: ocsfv1.3.0detectionfindingVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0detectionfindingWhois:
      title: ocsfv1.3.0detectionfindingWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0detectionfindingWhois_DnssecStatusId:
      title: ocsfv1.3.0detectionfindingWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityEmailAddress:
      title: ocsfv1.3.0dnsactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0dnsactivityFileName:
      title: ocsfv1.3.0dnsactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0dnsactivityHash:
      title: ocsfv1.3.0dnsactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0dnsactivityHostname:
      title: ocsfv1.3.0dnsactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0dnsactivityIPAddress:
      title: ocsfv1.3.0dnsactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0dnsactivityMACAddress:
      title: ocsfv1.3.0dnsactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0dnsactivityPort:
      title: ocsfv1.3.0dnsactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0dnsactivityProcessName:
      title: ocsfv1.3.0dnsactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0dnsactivitySubnet:
      title: ocsfv1.3.0dnsactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0dnsactivityTimestamp:
      title: ocsfv1.3.0dnsactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0dnsactivityURLString:
      title: ocsfv1.3.0dnsactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0dnsactivityUserName:
      title: ocsfv1.3.0dnsactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0dnsactivityActionId:
      title: ocsfv1.3.0dnsactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityActivityId:
      title: ocsfv1.3.0dnsactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Query: The DNS query request.

        2 - Response: The DNS query response.

        6 - Traffic: Bidirectional DNS request and response traffic.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityCategoryUid:
      title: ocsfv1.3.0dnsactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        4 - NetworkActivity: Network Activity events.
    ocsfv1.3.0dnsactivityClassUid:
      title: ocsfv1.3.0dnsactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        4003 - DNSActivity: DNS Activity events report DNS queries and answers
        as seen on the network.
    ocsfv1.3.0dnsactivityDispositionId:
      title: ocsfv1.3.0dnsactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityDnsActivity:
      title: ocsfv1.3.0dnsactivityDnsActivity
      type: object
      description: >-
        DNS Activity events report DNS queries and answers as seen on the
        network.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsAnswer'
          nullable: true
          description: The Domain Name System (DNS) answers.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        app_name:
          type: string
          nullable: true
          description: The name of the application associated with the event or object.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Network Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        connection_info:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkConnectionInfo'
          nullable: true
          description: The network connection information.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkEndpoint'
          nullable: true
          description: The responder (server) in a network connection.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        ja4_fingerprint_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityJa4Fingerprint'
          nullable: true
          description: A list of the JA4+ network fingerprints.
        load_balancer:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLoadBalancer'
          nullable: true
          description: >-
            The Load Balancer object contains information related to the device
            that is distributing incoming traffic to specified destinations.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        proxy:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_connection_info:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkConnectionInfo'
          nullable: true
          description: >-
            The connection information from the proxy server to the remote
            server.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_http_request:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHttpRequest'
          nullable: true
          description: The HTTP Request from the proxy server to the remote server.
        proxy_http_response:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHttpResponse'
          nullable: true
          description: The HTTP Response from the remote server to the proxy server.
        proxy_tls:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTls'
          nullable: true
          description: >-
            The TLS protocol negotiated between the proxy server and the remote
            server.
        proxy_traffic:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkTraffic'
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network, from proxy to remote server at a given point of time.
        query:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsQuery'
          nullable: true
          description: The Domain Name System (DNS) query.
        query_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The Domain Name System (DNS) query time.
        query_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The Domain Name System (DNS) query time.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        rcode:
          type: string
          nullable: true
          description: >-
            The DNS server response code, normalized to the caption of the
            rcode_id value. In the case of 'Other', it is defined by the event
            source.
        rcode_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityRcodeId'
          nullable: true
          description: >-
            The normalized identifier of the DNS server response code. See <a
            target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc6895'>RFC-6895</a>.
        response_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The Domain Name System (DNS) response time.
        response_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The Domain Name System (DNS) response time.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkEndpoint'
          nullable: true
          description: The initiator (client) of the network connection.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        tls:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTls'
          nullable: true
          description: The Transport Layer Security (TLS) attributes.
        traffic:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkTraffic'
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network at a given point of time. Intended to be used alongside
            Network Connection.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0dnsactivityRcodeId:
      title: ocsfv1.3.0dnsactivityRcodeId
      type: integer
      description: >-
        RcodeId is an enum, and the following values are allowed.

        0 - NoError: No Error.

        1 - FormError: Format Error.

        2 - ServError: Server Failure.

        3 - NXDomain: Non-Existent Domain.

        4 - NotImp: Not Implemented.

        5 - Refused: Query Refused.

        6 - YXDomain: Name Exists when it should not.

        7 - YXRRSet: RR Set Exists when it should not.

        8 - NXRRSet: RR Set that should exist does not.

        9 - NotAuth: Not Authorized or Server Not Authoritative for zone.

        10 - NotZone: Name not contained in zone.

        11 - DSOTYPENI: DSO-TYPE Not Implemented.

        16 - VERS: TSIG Signature Failure or Bad OPT Version.

        17 - BADKEY: Key not recognized.

        18 - BADTIME: Signature out of time window.

        19 - BADMODE: Bad TKEY Mode.

        20 - BADNAME: Duplicate key name.

        21 - BADALG: Algorithm not supported.

        22 - BADTRUNC: Bad Truncation.

        23 - BADCOOKIE: Bad/missing Server Cookie.

        24 - Unassigned: The codes deemed to be unassigned by the RFC
        (unassigned codes: 12-15, 24-3840, 4096-65534).

        25 - Reserved: The codes deemed to be reserved by the RFC (codes:
        3841-4095, 65535).

        99 - Other: The dns response code is not defined by the RFC.
    ocsfv1.3.0dnsactivitySeverityId:
      title: ocsfv1.3.0dnsactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityStatusId:
      title: ocsfv1.3.0dnsactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityTypeUid:
      title: ocsfv1.3.0dnsactivityTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        400300 - Unknown
        400301 - Query: The DNS query request.
        400302 - Response: The DNS query response.
        400306 - Traffic: Bidirectional DNS request and response traffic.
        400399 - Other
    ocsfv1.3.0dnsactivityAccount:
      title: ocsfv1.3.0dnsactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0dnsactivityAccount_TypeId:
      title: ocsfv1.3.0dnsactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0dnsactivityActor:
      title: ocsfv1.3.0dnsactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0dnsactivityActor_ActorTypeId:
      title: ocsfv1.3.0dnsactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityAffectedCode:
      title: ocsfv1.3.0dnsactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0dnsactivityAffectedPackage:
      title: ocsfv1.3.0dnsactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0dnsactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0dnsactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityAgent:
      title: ocsfv1.3.0dnsactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0dnsactivityAgent_TypeId:
      title: ocsfv1.3.0dnsactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityApi:
      title: ocsfv1.3.0dnsactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0dnsactivityAttack:
      title: ocsfv1.3.0dnsactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0dnsactivityAuthorization:
      title: ocsfv1.3.0dnsactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0dnsactivityAutonomousSystem:
      title: ocsfv1.3.0dnsactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0dnsactivityCertificate:
      title: ocsfv1.3.0dnsactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0dnsactivityCloud:
      title: ocsfv1.3.0dnsactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0dnsactivityContainer:
      title: ocsfv1.3.0dnsactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0dnsactivityCve:
      title: ocsfv1.3.0dnsactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0dnsactivityCvss:
      title: ocsfv1.3.0dnsactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0dnsactivityCvss_Depth:
      title: ocsfv1.3.0dnsactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0dnsactivityCwe:
      title: ocsfv1.3.0dnsactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0dnsactivityDevice:
      title: ocsfv1.3.0dnsactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0dnsactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0dnsactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0dnsactivityDevice_RiskLevelId:
      title: ocsfv1.3.0dnsactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityDevice_TypeId:
      title: ocsfv1.3.0dnsactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0dnsactivityDeviceHwInfo:
      title: ocsfv1.3.0dnsactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0dnsactivityDigitalSignature:
      title: ocsfv1.3.0dnsactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0dnsactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0dnsactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0dnsactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityDigitalSignature_StateId:
      title: ocsfv1.3.0dnsactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityDisplay:
      title: ocsfv1.3.0dnsactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0dnsactivityDnsAnswer:
      title: ocsfv1.3.0dnsactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0dnsactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0dnsactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityDnsQuery:
      title: ocsfv1.3.0dnsactivityDnsQuery
      type: object
      description: >-
        The DNS query object represents a specific request made to the Domain
        Name System (DNS) to retrieve information about a domain or perform a
        DNS operation. This object encapsulates the necessary attributes and
        methods to construct and send DNS queries, specify the query type (e.g.,
        A, AAAA, MX). Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DNSLookup/">d3f:DNSLookup</a>.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of resource records being queried. See <a target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHostname'
          description: >-
            The hostname or domain being queried. For example:
            <code>www.example.com</code>
        opcode:
          type: string
          nullable: true
          description: The DNS opcode specifies the type of the query message.
        opcode_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsQuery_OpcodeId'
          nullable: true
          description: >-
            The DNS opcode ID specifies the normalized query message type as
            defined in <a target='_blank'
            href='https://www.rfc-editor.org/rfc/rfc5395.html'>RFC-5395</a>.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        type:
          type: string
          nullable: true
          description: >-
            The type of resource records being queried. See <a target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: A, AAAA, CNAME, MX, and NS.
      required:
        - hostname
    ocsfv1.3.0dnsactivityDnsQuery_OpcodeId:
      title: ocsfv1.3.0dnsactivityDnsQuery_OpcodeId
      type: integer
      description: >-
        DnsQueryOpcodeId is an enum, and the following values are allowed.

        0 - Query: Standard query

        1 - InverseQuery: Inverse query, obsolete

        2 - Status: Server status request

        3 - Reserved: Reserved, not used

        4 - Notify: Zone change notification

        5 - Update: Dynamic DNS update

        6 - DSOMessage: DNS Stateful Operations (DSO)

        99 - Other: The DNS Opcode is not defined by the RFC. See the
        <code>opcode</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityDomainContact:
      title: ocsfv1.3.0dnsactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0dnsactivityDomainContact_TypeId:
      title: ocsfv1.3.0dnsactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityEmail:
      title: ocsfv1.3.0dnsactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0dnsactivityEmailAuth:
      title: ocsfv1.3.0dnsactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0dnsactivityEndpointConnection:
      title: ocsfv1.3.0dnsactivityEndpointConnection
      type: object
      description: >-
        The Endpoint Connection object contains information detailing a
        connection attempt to an endpoint.
      properties:
        code:
          type: integer
          nullable: true
          description: >-
            A numerical response status code providing details about the
            connection.
        network_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkEndpoint'
          nullable: true
          description: Provides characteristics of the network endpoint.
    ocsfv1.3.0dnsactivityEnrichment:
      title: ocsfv1.3.0dnsactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0dnsactivityEpss:
      title: ocsfv1.3.0dnsactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0dnsactivityExtension:
      title: ocsfv1.3.0dnsactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0dnsactivityFeature:
      title: ocsfv1.3.0dnsactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0dnsactivityFile:
      title: ocsfv1.3.0dnsactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0dnsactivityFile_ConfidentialityId:
      title: ocsfv1.3.0dnsactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityFile_TypeId:
      title: ocsfv1.3.0dnsactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityFingerprint:
      title: ocsfv1.3.0dnsactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0dnsactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0dnsactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityFirewallRule:
      title: ocsfv1.3.0dnsactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0dnsactivityGroup:
      title: ocsfv1.3.0dnsactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0dnsactivityHttpHeader:
      title: ocsfv1.3.0dnsactivityHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0dnsactivityHttpRequest:
      title: ocsfv1.3.0dnsactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0dnsactivityHttpRequest_HttpMethod:
      title: ocsfv1.3.0dnsactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0dnsactivityHttpResponse:
      title: ocsfv1.3.0dnsactivityHttpResponse
      type: object
      description: >-
        The HTTP Response object contains detailed information about the
        response sent from a web server to the requester. It encompasses
        attributes and metadata that describe the response status, headers, body
        content, and other relevant information.
      properties:
        code:
          type: integer
          description: >-
            The Hypertext Transfer Protocol (HTTP) status code returned from the
            web server to the client. For example, 200.
        content_type:
          type: string
          nullable: true
          description: >-
            The request header that identifies the original <a target="_blank"
            href="https://www.iana.org/assignments/media-types/media-types.xhtml">media
            type </a> of the resource (prior to any content encoding applied for
            sending).
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        latency:
          type: integer
          nullable: true
          description: The HTTP response latency measured in milliseconds.
        length:
          type: integer
          nullable: true
          description: The HTTP response length, in number of bytes.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        status:
          type: string
          nullable: true
          description: >-
            The response status. For example: A successful HTTP status of 'OK'
            which corresponds to a code of 200.
      required:
        - code
    ocsfv1.3.0dnsactivityIdp:
      title: ocsfv1.3.0dnsactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0dnsactivityImage:
      title: ocsfv1.3.0dnsactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0dnsactivityJa4Fingerprint:
      title: ocsfv1.3.0dnsactivityJa4Fingerprint
      type: object
      description: >-
        The JA4+ fingerprint object provides detailed fingerprint information
        about various aspects of network traffic which is both machine and human
        readable.
      properties:
        section_a:
          type: string
          nullable: true
          description: The 'a' section of the JA4 fingerprint.
        section_b:
          type: string
          nullable: true
          description: The 'b' section of the JA4 fingerprint.
        section_c:
          type: string
          nullable: true
          description: The 'c' section of the JA4 fingerprint.
        section_d:
          type: string
          nullable: true
          description: The 'd' section of the JA4 fingerprint.
        type:
          type: string
          nullable: true
          description: >-
            The JA4+ fingerprint type as defined by <a
            href="https://blog.foxio.io/ja4+-network-fingerprinting
            target=">FoxIO</a>, normalized to the caption of 'type_id'. In the
            case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityJa4Fingerprint_TypeId'
          description: The identifier of the JA4+ fingerprint type.
        value:
          type: string
          description: The JA4+ fingerprint value.
      required:
        - type_id
        - value
    ocsfv1.3.0dnsactivityJa4Fingerprint_TypeId:
      title: ocsfv1.3.0dnsactivityJa4Fingerprint_TypeId
      type: integer
      description: >-
        Ja4FingerprintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - JA4: TLS Client Fingerprint.

        2 - JA4Server: TLS Server Response/Session Fingerprint.

        3 - JA4HTTP: HTTP Client Fingerprint.

        4 - JA4Latency: Latency Measurement/Light Distance Fingerprint.

        5 - JA4X509: X509 TLS Certificate Fingerprint.

        6 - JA4SSH: SSH Traffic Fingerprint.

        7 - JA4TCP: Passive TCP Client Fingerprint.

        8 - JA4TCPServer: Passive TCP Server Fingerprint.

        9 - JA4TCPScan: Active TCP Server Fingerprint.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityKbArticle:
      title: ocsfv1.3.0dnsactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0dnsactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0dnsactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityKeyboardInfo:
      title: ocsfv1.3.0dnsactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0dnsactivityKillChainPhase:
      title: ocsfv1.3.0dnsactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0dnsactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0dnsactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityLdapPerson:
      title: ocsfv1.3.0dnsactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0dnsactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0dnsactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0dnsactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityLoadBalancer:
      title: ocsfv1.3.0dnsactivityLoadBalancer
      type: object
      description: >-
        The load balancer object describes the load balancer entity and contains
        additional information regarding the distribution of traffic across a
        network.
      properties:
        classification:
          type: string
          nullable: true
          description: The request classification as defined by the load balancer.
        code:
          type: integer
          nullable: true
          description: >-
            The numeric response status code detailing the connection from the
            load balancer to the destination target.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkEndpoint'
          nullable: true
          description: The destination to which the load balancer is distributing traffic.
        endpoint_connections:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEndpointConnection'
          nullable: true
          description: >-
            An object detailing the load balancer connection attempts and
            responses.
        error_message:
          type: string
          nullable: true
          description: The load balancer error message.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: >-
            The IP address of the load balancer node that handled the client
            request. Note: the load balancer may have other IP addresses, and
            this is not an IP address of the target/distribution endpoint - see
            <code>dst_endpoint</code>.
        message:
          type: string
          nullable: true
          description: The load balancer message.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMetric'
          nullable: true
          description: General purpose metrics associated with the load balancer.
        name:
          type: string
          nullable: true
          description: The name of the load balancer.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional status information about the
            load balancer distribution event.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the load balancer.
    ocsfv1.3.0dnsactivityLocation:
      title: ocsfv1.3.0dnsactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0dnsactivityLogger:
      title: ocsfv1.3.0dnsactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0dnsactivityMalware:
      title: ocsfv1.3.0dnsactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0dnsactivityMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0dnsactivityMalware_ClassificationIds:
      title: ocsfv1.3.0dnsactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityMetadata:
      title: ocsfv1.3.0dnsactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0dnsactivityMetric:
      title: ocsfv1.3.0dnsactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0dnsactivityNetworkConnectionInfo:
      title: ocsfv1.3.0dnsactivityNetworkConnectionInfo
      type: object
      description: >-
        The Network Connection Information object describes characteristics of a
        network connection. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/">d3f:NetworkSession</a>.
      properties:
        boundary:
          type: string
          nullable: true
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'. In the case of 'Other', it is defined by the event
            source. <p> For cloud connections, this translates to the
            traffic-boundary(same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        boundary_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0dnsactivityNetworkConnectionInfo_BoundaryId
          nullable: true
          description: >-
            <p>The normalized identifier of the boundary of the connection.
            </p><p> For cloud connections, this translates to the
            traffic-boundary (same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the initiated connection, traffic, or email,
            normalized to the caption of the direction_id value. In the case of
            'Other', it is defined by the event source.
        direction_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0dnsactivityNetworkConnectionInfo_DirectionId
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The TCP/IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>tcp</code> or <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The TCP/IP protocol number, as defined by the Internet Assigned
            Numbers Authority (IANA). Use -1 if the protocol is not defined by
            IANA. See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>6</code> for TCP and <code>17</code>
            for UDP.
        protocol_ver:
          type: string
          nullable: true
          description: The Internet Protocol version.
        protocol_ver_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0dnsactivityNetworkConnectionInfo_ProtocolVerId
          nullable: true
          description: The Internet Protocol version identifier.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySession'
          nullable: true
          description: The authenticated user or service session.
        tcp_flags:
          type: integer
          nullable: true
          description: The network connection TCP header flags (i.e., control bits).
        uid:
          type: string
          nullable: true
          description: The unique identifier of the connection.
      required:
        - direction_id
    ocsfv1.3.0dnsactivityNetworkConnectionInfo_BoundaryId:
      title: ocsfv1.3.0dnsactivityNetworkConnectionInfo_BoundaryId
      type: integer
      description: >-
        NetworkConnectionInfoBoundaryId is an enum, and the following values are
        allowed.

        0 - Unknown: The connection boundary is unknown.

        1 - Localhost: Local network traffic on the same endpoint.

        2 - Internal: Internal network traffic between two endpoints inside
        network.

        3 - External: External network traffic between two endpoints on the
        Internet or outside the network.

        4 - SameVPC: Through another resource in the same VPC

        5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint

        6 - VirtualPrivateGateway: Through a virtual private gateway

        7 - regionVPC: Through an intra-region VPC peering connection

        8 - regionVPC: Through an inter-region VPC peering connection

        9 - LocalGateway: Through a local gateway

        10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances
        only)

        11 - InternetGateway: Through an Internet gateway (Nitro-based instances
        only)

        99 - Other: The boundary is not mapped. See the <code>boundary</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityNetworkConnectionInfo_DirectionId:
      title: ocsfv1.3.0dnsactivityNetworkConnectionInfo_DirectionId
      type: integer
      description: >-
        NetworkConnectionInfoDirectionId is an enum, and the following values
        are allowed.

        0 - Unknown: The connection direction is unknown.

        1 - Inbound: Inbound network connection. The connection was originated
        from the Internet or outside network, destined for services on the
        inside network.

        2 - Outbound: Outbound network connection. The connection was originated
        from inside the network, destined for services on the Internet or
        outside network.

        3 - Lateral: Lateral network connection. The connection was originated
        from inside the network, destined for services on the inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0dnsactivityNetworkConnectionInfo_ProtocolVerId:
      title: ocsfv1.3.0dnsactivityNetworkConnectionInfo_ProtocolVerId
      type: integer
      description: >-
        NetworkConnectionInfoProtocolVerId is an enum, and the following values
        are allowed.

        0 - Unknown: The protocol version is unknown.

        4 - IPv4*

        6 - IPv6*

        99 - Other: The protocol version is not mapped. See the
        <code>protocol_ver</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityNetworkEndpoint:
      title: ocsfv1.3.0dnsactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0dnsactivityNetworkEndpoint_TypeId:
      title: ocsfv1.3.0dnsactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0dnsactivityNetworkInterface:
      title: ocsfv1.3.0dnsactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0dnsactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0dnsactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityNetworkProxy:
      title: ocsfv1.3.0dnsactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0dnsactivityNetworkProxy_TypeId:
      title: ocsfv1.3.0dnsactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0dnsactivityNetworkTraffic:
      title: ocsfv1.3.0dnsactivityNetworkTraffic
      type: object
      description: >-
        The Network Traffic object describes characteristics of network traffic.
        Network traffic refers to data moving across a network at a given point
        of time. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkTraffic/">d3f:NetworkTraffic</a>.
      properties:
        bytes:
          type: integer
          nullable: true
          description: The total number of bytes (in and out).
        bytes_in:
          type: integer
          nullable: true
          description: The number of bytes sent from the destination to the source.
        bytes_out:
          type: integer
          nullable: true
          description: The number of bytes sent from the source to the destination.
        chunks:
          type: integer
          nullable: true
          description: The total number of chunks (in and out).
        chunks_in:
          type: integer
          nullable: true
          description: The number of chunks sent from the destination to the source.
        chunks_out:
          type: integer
          nullable: true
          description: The number of chunks sent from the source to the destination.
        packets:
          type: integer
          nullable: true
          description: The total number of packets (in and out).
        packets_in:
          type: integer
          nullable: true
          description: The number of packets sent from the destination to the source.
        packets_out:
          type: integer
          nullable: true
          description: The number of packets sent from the source to the destination.
    ocsfv1.3.0dnsactivityObject:
      title: ocsfv1.3.0dnsactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0dnsactivityObservable:
      title: ocsfv1.3.0dnsactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0dnsactivityObservable_TypeId:
      title: ocsfv1.3.0dnsactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0dnsactivityOrganization:
      title: ocsfv1.3.0dnsactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0dnsactivityOs:
      title: ocsfv1.3.0dnsactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0dnsactivityOs_TypeId:
      title: ocsfv1.3.0dnsactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0dnsactivityOsint:
      title: ocsfv1.3.0dnsactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0dnsactivityOsint_ConfidenceId:
      title: ocsfv1.3.0dnsactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityOsint_Tlp:
      title: ocsfv1.3.0dnsactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0dnsactivityOsint_TypeId:
      title: ocsfv1.3.0dnsactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0dnsactivityPackage:
      title: ocsfv1.3.0dnsactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0dnsactivityPackage_TypeId:
      title: ocsfv1.3.0dnsactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityPolicy:
      title: ocsfv1.3.0dnsactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0dnsactivityProcess:
      title: ocsfv1.3.0dnsactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0dnsactivityProcess_IntegrityId:
      title: ocsfv1.3.0dnsactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityProduct:
      title: ocsfv1.3.0dnsactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0dnsactivityRemediation:
      title: ocsfv1.3.0dnsactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0dnsactivityReputation:
      title: ocsfv1.3.0dnsactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0dnsactivityReputation_ScoreId:
      title: ocsfv1.3.0dnsactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityRequest:
      title: ocsfv1.3.0dnsactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0dnsactivityResponse:
      title: ocsfv1.3.0dnsactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0dnsactivitySan:
      title: ocsfv1.3.0dnsactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.3.0dnsactivityService:
      title: ocsfv1.3.0dnsactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0dnsactivitySession:
      title: ocsfv1.3.0dnsactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0dnsactivitySubTechnique:
      title: ocsfv1.3.0dnsactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0dnsactivityTactic:
      title: ocsfv1.3.0dnsactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0dnsactivityTechnique:
      title: ocsfv1.3.0dnsactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0dnsactivityTimespan:
      title: ocsfv1.3.0dnsactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0dnsactivityTimespan_TypeId:
      title: ocsfv1.3.0dnsactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityTls:
      title: ocsfv1.3.0dnsactivityTls
      type: object
      description: >-
        The Transport Layer Security (TLS) object describes the negotiated TLS
        protocol used for secure communications over an establish network
        connection.
      properties:
        alert:
          type: integer
          nullable: true
          description: >-
            The integer value of TLS alert if present. The alerts are defined in
            the TLS specification in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc2246">RFC-2246</a>.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        certificate_chain:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Chain of Certificate Serial Numbers field provides a chain of
            Certificate Issuer Serial Numbers leading to the Root Certificate
            Issuer.
        cipher:
          type: string
          nullable: true
          description: The negotiated cipher suite.
        client_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The client cipher suites that were exchanged during the TLS
            handshake negotiation.
        extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        handshake_dur:
          type: integer
          nullable: true
          description: >-
            The amount of total time for the TLS handshake to complete after the
            TCP connection is established, including client-side delays, in
            milliseconds.
        ja3_hash:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3 string.
        ja3s_hash:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3S string.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        server_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The server cipher suites that were exchanged during the TLS
            handshake negotiation.
        sni:
          type: string
          nullable: true
          description: The Server Name Indication (SNI) extension sent by the client.
        tls_extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        version:
          type: string
          description: The TLS protocol version.
      required:
        - version
    ocsfv1.3.0dnsactivityTlsExtension:
      title: ocsfv1.3.0dnsactivityTlsExtension
      type: object
      description: >-
        The TLS Extension object describes additional attributes that extend the
        base Transport Layer Security (TLS) object.
      properties:
        data:
          nullable: true
          description: >-
            The data contains information specific to the particular extension
            type.
        type:
          type: string
          nullable: true
          description: 'The TLS extension type. For example: <code>Server Name</code>.'
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTlsExtension_TypeId'
          description: >-
            The TLS extension type identifier. See <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc8446#page-35'>The
            Transport Layer Security (TLS) extension page</a>.
      required:
        - type_id
    ocsfv1.3.0dnsactivityTlsExtension_TypeId:
      title: ocsfv1.3.0dnsactivityTlsExtension_TypeId
      type: integer
      description: >-
        TlsExtensionTypeId is an enum, and the following values are allowed.

        0 - name: The Server Name Indication extension.

        1 - fragment_length: The Maximum Fragment Length Negotiation extension.

        5 - request: The Certificate Status Request extension.

        10 - groups: The Supported Groups extension.

        13 - algorithms: The Signature Algorithms extension.

        14 - srtp: The Use SRTP data protection extension.

        15 - heartbeat: The Heartbeat extension.

        16 - layer_protocol_negotiation: The Application-Layer Protocol
        Negotiation extension.

        18 - certificate_timestamp: The Signed Certificate Timestamp extension.

        19 - certificate_type: The Client Certificate Type extension.

        20 - certificate_type: The Server Certificate Type extension.

        21 - padding: The Padding extension.

        41 - shared_key: The Pre Shared Key extension.

        42 - data: The Early Data extension.

        43 - versions: The Supported Versions extension.

        44 - cookie: The Cookie extension.

        45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension.

        47 - authorities: The Certificate Authorities extension.

        48 - filters: The OID Filters extension.

        49 - handshake_auth: The Post-Handshake Client Authentication extension.

        50 - algorithms_cert: The Signature Algorithms extension.

        51 - share: The Key Share extension.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityUrl:
      title: ocsfv1.3.0dnsactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0dnsactivityUrl_CategoryIds:
      title: ocsfv1.3.0dnsactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0dnsactivityUser:
      title: ocsfv1.3.0dnsactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0dnsactivityUser_MfaStatusId:
      title: ocsfv1.3.0dnsactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityUser_RiskLevelId:
      title: ocsfv1.3.0dnsactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0dnsactivityUser_TypeId:
      title: ocsfv1.3.0dnsactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0dnsactivityUser_UserStatusId:
      title: ocsfv1.3.0dnsactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0dnsactivityVulnerability:
      title: ocsfv1.3.0dnsactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0dnsactivityWhois:
      title: ocsfv1.3.0dnsactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0dnsactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0dnsactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0dnsactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0dnsactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementEmailAddress:
      title: ocsfv1.3.0entitymanagementEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0entitymanagementFileName:
      title: ocsfv1.3.0entitymanagementFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0entitymanagementHash:
      title: ocsfv1.3.0entitymanagementHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0entitymanagementHostname:
      title: ocsfv1.3.0entitymanagementHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0entitymanagementIPAddress:
      title: ocsfv1.3.0entitymanagementIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0entitymanagementMACAddress:
      title: ocsfv1.3.0entitymanagementMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0entitymanagementPort:
      title: ocsfv1.3.0entitymanagementPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0entitymanagementProcessName:
      title: ocsfv1.3.0entitymanagementProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0entitymanagementSubnet:
      title: ocsfv1.3.0entitymanagementSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0entitymanagementTimestamp:
      title: ocsfv1.3.0entitymanagementTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0entitymanagementURLString:
      title: ocsfv1.3.0entitymanagementURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0entitymanagementUserName:
      title: ocsfv1.3.0entitymanagementUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0entitymanagementActivityId:
      title: ocsfv1.3.0entitymanagementActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: Create a new managed entity.

        2 - Read: Read an existing managed entity.

        3 - Update: Update an existing managed entity.

        4 - Delete: Delete a managed entity.

        5 - Move: Move or rename an existing managed entity.

        6 - Enroll: Enroll an existing managed entity.

        7 - Unenroll: Unenroll an existing managed entity.

        8 - Enable: Enable an existing managed entity. Note: This is typically
        regarded as a semi-permanent, editor visible, syncable change.

        9 - Disable: Disable an existing managed entity. Note: This is typically
        regarded as a semi-permanent, editor visible, syncable change.

        10 - Activate: Activate an existing managed entity. Note: This is a
        typically regarded as a transient change, a change of state of the
        engine.

        11 - Deactivate: Deactivate an existing managed entity. Note: This is a
        typically regarded as a transient change, a change of state of the
        engine.

        12 - Suspend: Suspend an existing managed entity.

        13 - Resume: Resume (unsuspend) an existing managed entity.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementCategoryUid:
      title: ocsfv1.3.0entitymanagementCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        3 - AccessManagement: Identity &amp; Access Management (IAM) events
        relate to the supervision of the system's authentication and access
        control model. Examples of such events are the success or failure of
        authentication, granting of authority, password change, entity change,
        privileged use etc.
    ocsfv1.3.0entitymanagementClassUid:
      title: ocsfv1.3.0entitymanagementClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        3004 - EntityManagement: Entity Management events report activity by a
        managed client, a micro service, or a user at a management console. The
        activity can be a create, read, update, and delete operation on a
        managed entity.
    ocsfv1.3.0entitymanagementEntityManagement:
      title: ocsfv1.3.0entitymanagementEntityManagement
      type: object
      description: >-
        Entity Management events report activity by a managed client, a micro
        service, or a user at a management console. The activity can be a
        create, read, update, and delete operation on a managed entity.
      properties:
        access_list:
          type: array
          items:
            type: string
          nullable: true
          description: The list of requested access rights.
        access_mask:
          type: integer
          nullable: true
          description: The access mask in a platform-native format.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementActor'
          nullable: true
          description: >-
            Used for when the entity acting upon another entity is a process or
            user.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Identity &amp; Access Management</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        comment:
          type: string
          nullable: true
          description: The user provided comment about why the entity was changed.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        entity:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementManagedEntity'
          description: The managed entity that is being acted upon.
        entity_result:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementManagedEntity'
          nullable: true
          description: The updated managed entity.
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementNetworkEndpoint'
          nullable: true
          description: Details about the source of the IAM activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - entity
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0entitymanagementSeverityId:
      title: ocsfv1.3.0entitymanagementSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0entitymanagementStatusId:
      title: ocsfv1.3.0entitymanagementStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0entitymanagementTypeUid:
      title: ocsfv1.3.0entitymanagementTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        300400 - Unknown

        300401 - Create: Create a new managed entity.

        300402 - Read: Read an existing managed entity.

        300403 - Update: Update an existing managed entity.

        300404 - Delete: Delete a managed entity.

        300405 - Move: Move or rename an existing managed entity.

        300406 - Enroll: Enroll an existing managed entity.

        300407 - Unenroll: Unenroll an existing managed entity.

        300408 - Enable: Enable an existing managed entity. Note: This is
        typically regarded as a semi-permanent, editor visible, syncable change.

        300409 - Disable: Disable an existing managed entity. Note: This is
        typically regarded as a semi-permanent, editor visible, syncable change.

        300410 - Activate: Activate an existing managed entity. Note: This is a
        typically regarded as a transient change, a change of state of the
        engine.

        300411 - Deactivate: Deactivate an existing managed entity. Note: This
        is a typically regarded as a transient change, a change of state of the
        engine.

        300412 - Suspend: Suspend an existing managed entity.

        300413 - Resume: Resume (unsuspend) an existing managed entity.

        300499 - Other
    ocsfv1.3.0entitymanagementAccount:
      title: ocsfv1.3.0entitymanagementAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0entitymanagementAccount_TypeId:
      title: ocsfv1.3.0entitymanagementAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0entitymanagementActor:
      title: ocsfv1.3.0entitymanagementActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0entitymanagementActor_ActorTypeId:
      title: ocsfv1.3.0entitymanagementActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementAffectedCode:
      title: ocsfv1.3.0entitymanagementAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0entitymanagementAffectedPackage:
      title: ocsfv1.3.0entitymanagementAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0entitymanagementAffectedPackage_TypeId:
      title: ocsfv1.3.0entitymanagementAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementAgent:
      title: ocsfv1.3.0entitymanagementAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0entitymanagementAgent_TypeId:
      title: ocsfv1.3.0entitymanagementAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementApi:
      title: ocsfv1.3.0entitymanagementApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0entitymanagementAttack:
      title: ocsfv1.3.0entitymanagementAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0entitymanagementAuthorization:
      title: ocsfv1.3.0entitymanagementAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0entitymanagementAutonomousSystem:
      title: ocsfv1.3.0entitymanagementAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0entitymanagementCertificate:
      title: ocsfv1.3.0entitymanagementCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0entitymanagementCloud:
      title: ocsfv1.3.0entitymanagementCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0entitymanagementContainer:
      title: ocsfv1.3.0entitymanagementContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0entitymanagementCve:
      title: ocsfv1.3.0entitymanagementCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0entitymanagementCvss:
      title: ocsfv1.3.0entitymanagementCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0entitymanagementCvss_Depth:
      title: ocsfv1.3.0entitymanagementCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0entitymanagementCwe:
      title: ocsfv1.3.0entitymanagementCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0entitymanagementDevice:
      title: ocsfv1.3.0entitymanagementDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0entitymanagementDevice_NetworkStatusId:
      title: ocsfv1.3.0entitymanagementDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0entitymanagementDevice_RiskLevelId:
      title: ocsfv1.3.0entitymanagementDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0entitymanagementDevice_TypeId:
      title: ocsfv1.3.0entitymanagementDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0entitymanagementDeviceHwInfo:
      title: ocsfv1.3.0entitymanagementDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0entitymanagementDigitalSignature:
      title: ocsfv1.3.0entitymanagementDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0entitymanagementDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0entitymanagementDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0entitymanagementDigitalSignature_StateId:
      title: ocsfv1.3.0entitymanagementDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0entitymanagementDisplay:
      title: ocsfv1.3.0entitymanagementDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0entitymanagementDnsAnswer:
      title: ocsfv1.3.0entitymanagementDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0entitymanagementDnsAnswer_FlagIds:
      title: ocsfv1.3.0entitymanagementDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0entitymanagementDomainContact:
      title: ocsfv1.3.0entitymanagementDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0entitymanagementDomainContact_TypeId:
      title: ocsfv1.3.0entitymanagementDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementEmail:
      title: ocsfv1.3.0entitymanagementEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0entitymanagementEmailAuth:
      title: ocsfv1.3.0entitymanagementEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0entitymanagementEnrichment:
      title: ocsfv1.3.0entitymanagementEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0entitymanagementEpss:
      title: ocsfv1.3.0entitymanagementEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0entitymanagementExtension:
      title: ocsfv1.3.0entitymanagementExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0entitymanagementFeature:
      title: ocsfv1.3.0entitymanagementFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0entitymanagementFile:
      title: ocsfv1.3.0entitymanagementFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0entitymanagementFile_ConfidentialityId:
      title: ocsfv1.3.0entitymanagementFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementFile_TypeId:
      title: ocsfv1.3.0entitymanagementFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementFingerprint:
      title: ocsfv1.3.0entitymanagementFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0entitymanagementFingerprint_AlgorithmId:
      title: ocsfv1.3.0entitymanagementFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0entitymanagementGroup:
      title: ocsfv1.3.0entitymanagementGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0entitymanagementHttpHeader:
      title: ocsfv1.3.0entitymanagementHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0entitymanagementHttpRequest:
      title: ocsfv1.3.0entitymanagementHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementHttpRequest_HttpMethod
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0entitymanagementHttpRequest_HttpMethod:
      title: ocsfv1.3.0entitymanagementHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0entitymanagementIdp:
      title: ocsfv1.3.0entitymanagementIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0entitymanagementImage:
      title: ocsfv1.3.0entitymanagementImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0entitymanagementKbArticle:
      title: ocsfv1.3.0entitymanagementKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0entitymanagementKbArticle_InstallStateId:
      title: ocsfv1.3.0entitymanagementKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementKeyboardInfo:
      title: ocsfv1.3.0entitymanagementKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0entitymanagementKillChainPhase:
      title: ocsfv1.3.0entitymanagementKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0entitymanagementKillChainPhase_PhaseId:
      title: ocsfv1.3.0entitymanagementKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0entitymanagementLdapPerson:
      title: ocsfv1.3.0entitymanagementLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0entitymanagementLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0entitymanagementLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementLocation:
      title: ocsfv1.3.0entitymanagementLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0entitymanagementLogger:
      title: ocsfv1.3.0entitymanagementLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0entitymanagementManagedEntity:
      title: ocsfv1.3.0entitymanagementManagedEntity
      type: object
      description: >-
        The Managed Entity object describes the type and version of an entity,
        such as a user, device, or policy. For types in the <code>type_id</code>
        enum list, an associated attribute should be populated. If the type of
        entity is not in the <code>type_id</code> list, information can be put
        into the <code>data</code> attribute and the <code>type</code> attribute
        should identify the entity.
      properties:
        data:
          nullable: true
          description: The managed entity content as a JSON object.
        device:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDevice'
          nullable: true
          description: An addressable device, computer system or host.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmail'
          nullable: true
          description: The email object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: >-
            The group object associated with an entity such as user, policy, or
            rule.
        name:
          type: string
          nullable: true
          description: The name of the managed entity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPolicy'
          nullable: true
          description: Describes details of a managed policy.
        type:
          type: string
          nullable: true
          description: >-
            The managed entity type. For example: <code>policy</code>,
            <code>user</code>, <code>organizational unit</code>,
            <code>device</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementManagedEntity_TypeId'
          nullable: true
          description: >-
            The type of the Managed Entity. It is recommended to also populate
            the <code>type</code> attribute with the associated label, or the
            source specific name if <code>Other</code>.
        uid:
          type: string
          nullable: true
          description: The identifier of the managed entity.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: The user that pertains to the event or object.
        version:
          type: string
          nullable: true
          description: 'The version of the managed entity. For example: <code>1.2.3</code>.'
    ocsfv1.3.0entitymanagementManagedEntity_TypeId:
      title: ocsfv1.3.0entitymanagementManagedEntity_TypeId
      type: integer
      description: >-
        ManagedEntityTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Device: A managed Device entity. This item corresponds to population
        of the <code>device</code> attribute.

        2 - User: A managed User entity. This item corresponds to population of
        the <code>user</code> attribute.

        3 - Group: A managed Group entity. This item corresponds to population
        of the <code>group</code> attribute.

        4 - Organization: A managed Organization entity. This item corresponds
        to population of the <code>org</code> attribute.

        5 - Policy: A managed Policy entity. This item corresponds to population
        of the <code>policy</code> attribute.

        6 - Email: A managed Email entity. This item corresponds to population
        of the <code>email</code> attribute.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementMetadata:
      title: ocsfv1.3.0entitymanagementMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0entitymanagementMetric:
      title: ocsfv1.3.0entitymanagementMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0entitymanagementNetworkEndpoint:
      title: ocsfv1.3.0entitymanagementNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementNetworkEndpoint_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0entitymanagementNetworkEndpoint_TypeId:
      title: ocsfv1.3.0entitymanagementNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0entitymanagementNetworkInterface:
      title: ocsfv1.3.0entitymanagementNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0entitymanagementNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0entitymanagementNetworkInterface_TypeId:
      title: ocsfv1.3.0entitymanagementNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementNetworkProxy:
      title: ocsfv1.3.0entitymanagementNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0entitymanagementNetworkProxy_TypeId:
      title: ocsfv1.3.0entitymanagementNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0entitymanagementObject:
      title: ocsfv1.3.0entitymanagementObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0entitymanagementObservable:
      title: ocsfv1.3.0entitymanagementObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0entitymanagementObservable_TypeId:
      title: ocsfv1.3.0entitymanagementObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0entitymanagementOrganization:
      title: ocsfv1.3.0entitymanagementOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0entitymanagementOs:
      title: ocsfv1.3.0entitymanagementOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0entitymanagementOs_TypeId:
      title: ocsfv1.3.0entitymanagementOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0entitymanagementOsint:
      title: ocsfv1.3.0entitymanagementOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0entitymanagementOsint_ConfidenceId:
      title: ocsfv1.3.0entitymanagementOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementOsint_Tlp:
      title: ocsfv1.3.0entitymanagementOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0entitymanagementOsint_TypeId:
      title: ocsfv1.3.0entitymanagementOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0entitymanagementPackage:
      title: ocsfv1.3.0entitymanagementPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0entitymanagementPackage_TypeId:
      title: ocsfv1.3.0entitymanagementPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementPolicy:
      title: ocsfv1.3.0entitymanagementPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0entitymanagementProcess:
      title: ocsfv1.3.0entitymanagementProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0entitymanagementProcess_IntegrityId:
      title: ocsfv1.3.0entitymanagementProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0entitymanagementProduct:
      title: ocsfv1.3.0entitymanagementProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0entitymanagementRemediation:
      title: ocsfv1.3.0entitymanagementRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0entitymanagementReputation:
      title: ocsfv1.3.0entitymanagementReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0entitymanagementReputation_ScoreId:
      title: ocsfv1.3.0entitymanagementReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0entitymanagementRequest:
      title: ocsfv1.3.0entitymanagementRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0entitymanagementResponse:
      title: ocsfv1.3.0entitymanagementResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0entitymanagementService:
      title: ocsfv1.3.0entitymanagementService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0entitymanagementSession:
      title: ocsfv1.3.0entitymanagementSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0entitymanagementSubTechnique:
      title: ocsfv1.3.0entitymanagementSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0entitymanagementTactic:
      title: ocsfv1.3.0entitymanagementTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0entitymanagementTechnique:
      title: ocsfv1.3.0entitymanagementTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0entitymanagementTimespan:
      title: ocsfv1.3.0entitymanagementTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0entitymanagementTimespan_TypeId:
      title: ocsfv1.3.0entitymanagementTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementUrl:
      title: ocsfv1.3.0entitymanagementUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0entitymanagementUrl_CategoryIds:
      title: ocsfv1.3.0entitymanagementUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0entitymanagementUser:
      title: ocsfv1.3.0entitymanagementUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0entitymanagementUser_MfaStatusId:
      title: ocsfv1.3.0entitymanagementUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementUser_RiskLevelId:
      title: ocsfv1.3.0entitymanagementUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0entitymanagementUser_TypeId:
      title: ocsfv1.3.0entitymanagementUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0entitymanagementUser_UserStatusId:
      title: ocsfv1.3.0entitymanagementUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0entitymanagementVulnerability:
      title: ocsfv1.3.0entitymanagementVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0entitymanagementWhois:
      title: ocsfv1.3.0entitymanagementWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0entitymanagementDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0entitymanagementSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0entitymanagementWhois_DnssecStatusId:
      title: ocsfv1.3.0entitymanagementWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityEmailAddress:
      title: ocsfv1.3.0fileactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0fileactivityFileName:
      title: ocsfv1.3.0fileactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0fileactivityHash:
      title: ocsfv1.3.0fileactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0fileactivityHostname:
      title: ocsfv1.3.0fileactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0fileactivityIPAddress:
      title: ocsfv1.3.0fileactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0fileactivityMACAddress:
      title: ocsfv1.3.0fileactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0fileactivityPort:
      title: ocsfv1.3.0fileactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0fileactivityProcessName:
      title: ocsfv1.3.0fileactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0fileactivitySubnet:
      title: ocsfv1.3.0fileactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0fileactivityTimestamp:
      title: ocsfv1.3.0fileactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0fileactivityURLString:
      title: ocsfv1.3.0fileactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0fileactivityUserName:
      title: ocsfv1.3.0fileactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0fileactivityActionId:
      title: ocsfv1.3.0fileactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0fileactivityActivityId:
      title: ocsfv1.3.0fileactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A request to create a new file on a file system.

        2 - Read: A request to read data from a file on a file system.

        3 - Update: A request to write data to a file on a file system.

        4 - Delete: A request to delete a file on a file system.

        5 - Rename: A request to rename a file on a file system.

        6 - SetAttributes: A request to set attributes for a file on a file
        system.

        7 - SetSecurity: A request to set security for a file on a file system.

        8 - GetAttributes: A request to get attributes for a file on a file
        system.

        9 - GetSecurity: A request to get security for a file on a file system.

        10 - Encrypt: A request to encrypt a file on a file system.

        11 - Decrypt: A request to decrypt a file on a file system.

        12 - Mount: A request to mount a file on a file system.

        13 - Unmount: A request to unmount a file from a file system.

        14 - Open: A request to create a file handle.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityCategoryUid:
      title: ocsfv1.3.0fileactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        1 - SystemActivity: System Activity events.
    ocsfv1.3.0fileactivityClassUid:
      title: ocsfv1.3.0fileactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        1001 - FileSystemActivity: File System Activity events report when a
        process performs an action on a file or folder.
    ocsfv1.3.0fileactivityDispositionId:
      title: ocsfv1.3.0fileactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityFileActivity:
      title: ocsfv1.3.0fileactivityFileActivity
      type: object
      description: >-
        File System Activity events report when a process performs an action on
        a file or folder.
      properties:
        access_mask:
          type: integer
          nullable: true
          description: The access mask in a platform-native format.
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityActor'
          description: >-
            The actor that performed the activity on the <code>file</code>
            object
        api:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>System Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        component:
          type: string
          nullable: true
          description: >-
            <p>The name or relative pathname of a sub-component of the data
            object, if applicable. </p>For example: <code>attachment.doc</code>,
            <code>attachment.zip/bad.doc</code>, or
            <code>part.mime/part.cab/part.uue/part.doc</code>.
        connection_uid:
          type: string
          nullable: true
          description: The network connection identifier.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        create_mask:
          type: string
          nullable: true
          description: The original Windows mask that is required to create the object.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDevice'
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        file:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile'
          description: The file that is the target of the activity.
        file_diff:
          type: string
          nullable: true
          description: >-
            File content differences used for change detection. For example, a
            common use case is to identify itemized changes within INI or
            configuration/property setting values.
        file_result:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile'
          nullable: true
          description: >-
            The resulting file object when the activity was allowed and
            successful.
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - actor
        - category_uid
        - class_uid
        - device
        - file
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0fileactivitySeverityId:
      title: ocsfv1.3.0fileactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0fileactivityStatusId:
      title: ocsfv1.3.0fileactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0fileactivityTypeUid:
      title: ocsfv1.3.0fileactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        100100 - Unknown

        100101 - Create: A request to create a new file on a file system.

        100102 - Read: A request to read data from a file on a file system.

        100103 - Update: A request to write data to a file on a file system.

        100104 - Delete: A request to delete a file on a file system.

        100105 - Rename: A request to rename a file on a file system.

        100106 - SetAttributes: A request to set attributes for a file on a file
        system.

        100107 - SetSecurity: A request to set security for a file on a file
        system.

        100108 - GetAttributes: A request to get attributes for a file on a file
        system.

        100109 - GetSecurity: A request to get security for a file on a file
        system.

        100110 - Encrypt: A request to encrypt a file on a file system.

        100111 - Decrypt: A request to decrypt a file on a file system.

        100112 - Mount: A request to mount a file on a file system.

        100113 - Unmount: A request to unmount a file from a file system.

        100114 - Open: A request to create a file handle.

        100199 - Other
    ocsfv1.3.0fileactivityAccount:
      title: ocsfv1.3.0fileactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0fileactivityAccount_TypeId:
      title: ocsfv1.3.0fileactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0fileactivityActor:
      title: ocsfv1.3.0fileactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0fileactivityActor_ActorTypeId:
      title: ocsfv1.3.0fileactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityAffectedCode:
      title: ocsfv1.3.0fileactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0fileactivityAffectedPackage:
      title: ocsfv1.3.0fileactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0fileactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0fileactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityAgent:
      title: ocsfv1.3.0fileactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0fileactivityAgent_TypeId:
      title: ocsfv1.3.0fileactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityApi:
      title: ocsfv1.3.0fileactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0fileactivityAttack:
      title: ocsfv1.3.0fileactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0fileactivityAuthorization:
      title: ocsfv1.3.0fileactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0fileactivityAutonomousSystem:
      title: ocsfv1.3.0fileactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0fileactivityCertificate:
      title: ocsfv1.3.0fileactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0fileactivityCloud:
      title: ocsfv1.3.0fileactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0fileactivityContainer:
      title: ocsfv1.3.0fileactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0fileactivityCve:
      title: ocsfv1.3.0fileactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0fileactivityCvss:
      title: ocsfv1.3.0fileactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0fileactivityCvss_Depth:
      title: ocsfv1.3.0fileactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0fileactivityCwe:
      title: ocsfv1.3.0fileactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0fileactivityDevice:
      title: ocsfv1.3.0fileactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0fileactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0fileactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0fileactivityDevice_RiskLevelId:
      title: ocsfv1.3.0fileactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0fileactivityDevice_TypeId:
      title: ocsfv1.3.0fileactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0fileactivityDeviceHwInfo:
      title: ocsfv1.3.0fileactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0fileactivityDigitalSignature:
      title: ocsfv1.3.0fileactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0fileactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0fileactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0fileactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0fileactivityDigitalSignature_StateId:
      title: ocsfv1.3.0fileactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0fileactivityDisplay:
      title: ocsfv1.3.0fileactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0fileactivityDnsAnswer:
      title: ocsfv1.3.0fileactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0fileactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0fileactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0fileactivityDomainContact:
      title: ocsfv1.3.0fileactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0fileactivityDomainContact_TypeId:
      title: ocsfv1.3.0fileactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityEmail:
      title: ocsfv1.3.0fileactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0fileactivityEmailAuth:
      title: ocsfv1.3.0fileactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0fileactivityEnrichment:
      title: ocsfv1.3.0fileactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0fileactivityEpss:
      title: ocsfv1.3.0fileactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0fileactivityExtension:
      title: ocsfv1.3.0fileactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0fileactivityFeature:
      title: ocsfv1.3.0fileactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0fileactivityFile:
      title: ocsfv1.3.0fileactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0fileactivityFile_ConfidentialityId:
      title: ocsfv1.3.0fileactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityFile_TypeId:
      title: ocsfv1.3.0fileactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityFingerprint:
      title: ocsfv1.3.0fileactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0fileactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0fileactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0fileactivityFirewallRule:
      title: ocsfv1.3.0fileactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0fileactivityGroup:
      title: ocsfv1.3.0fileactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0fileactivityIdp:
      title: ocsfv1.3.0fileactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0fileactivityImage:
      title: ocsfv1.3.0fileactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0fileactivityKbArticle:
      title: ocsfv1.3.0fileactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0fileactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0fileactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityKeyboardInfo:
      title: ocsfv1.3.0fileactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0fileactivityKillChainPhase:
      title: ocsfv1.3.0fileactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0fileactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0fileactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0fileactivityLdapPerson:
      title: ocsfv1.3.0fileactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0fileactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0fileactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0fileactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityLocation:
      title: ocsfv1.3.0fileactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0fileactivityLogger:
      title: ocsfv1.3.0fileactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0fileactivityMalware:
      title: ocsfv1.3.0fileactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0fileactivityMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0fileactivityMalware_ClassificationIds:
      title: ocsfv1.3.0fileactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityMetadata:
      title: ocsfv1.3.0fileactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0fileactivityMetric:
      title: ocsfv1.3.0fileactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0fileactivityNetworkInterface:
      title: ocsfv1.3.0fileactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0fileactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0fileactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityObject:
      title: ocsfv1.3.0fileactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0fileactivityObservable:
      title: ocsfv1.3.0fileactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0fileactivityObservable_TypeId:
      title: ocsfv1.3.0fileactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0fileactivityOrganization:
      title: ocsfv1.3.0fileactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0fileactivityOs:
      title: ocsfv1.3.0fileactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0fileactivityOs_TypeId:
      title: ocsfv1.3.0fileactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0fileactivityOsint:
      title: ocsfv1.3.0fileactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0fileactivityOsint_ConfidenceId:
      title: ocsfv1.3.0fileactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityOsint_Tlp:
      title: ocsfv1.3.0fileactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0fileactivityOsint_TypeId:
      title: ocsfv1.3.0fileactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0fileactivityPackage:
      title: ocsfv1.3.0fileactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0fileactivityPackage_TypeId:
      title: ocsfv1.3.0fileactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityPolicy:
      title: ocsfv1.3.0fileactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0fileactivityProcess:
      title: ocsfv1.3.0fileactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0fileactivityProcess_IntegrityId:
      title: ocsfv1.3.0fileactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0fileactivityProduct:
      title: ocsfv1.3.0fileactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0fileactivityRemediation:
      title: ocsfv1.3.0fileactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0fileactivityReputation:
      title: ocsfv1.3.0fileactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0fileactivityReputation_ScoreId:
      title: ocsfv1.3.0fileactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0fileactivityRequest:
      title: ocsfv1.3.0fileactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0fileactivityResponse:
      title: ocsfv1.3.0fileactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0fileactivityService:
      title: ocsfv1.3.0fileactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0fileactivitySession:
      title: ocsfv1.3.0fileactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0fileactivitySubTechnique:
      title: ocsfv1.3.0fileactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0fileactivityTactic:
      title: ocsfv1.3.0fileactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0fileactivityTechnique:
      title: ocsfv1.3.0fileactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0fileactivityTimespan:
      title: ocsfv1.3.0fileactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0fileactivityTimespan_TypeId:
      title: ocsfv1.3.0fileactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityUrl:
      title: ocsfv1.3.0fileactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0fileactivityUrl_CategoryIds:
      title: ocsfv1.3.0fileactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0fileactivityUser:
      title: ocsfv1.3.0fileactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0fileactivityUser_MfaStatusId:
      title: ocsfv1.3.0fileactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityUser_RiskLevelId:
      title: ocsfv1.3.0fileactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0fileactivityUser_TypeId:
      title: ocsfv1.3.0fileactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0fileactivityUser_UserStatusId:
      title: ocsfv1.3.0fileactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0fileactivityVulnerability:
      title: ocsfv1.3.0fileactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0fileactivityWhois:
      title: ocsfv1.3.0fileactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0fileactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0fileactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0fileactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0fileactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementEmailAddress:
      title: ocsfv1.3.0groupmanagementEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0groupmanagementFileName:
      title: ocsfv1.3.0groupmanagementFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0groupmanagementHash:
      title: ocsfv1.3.0groupmanagementHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0groupmanagementHostname:
      title: ocsfv1.3.0groupmanagementHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0groupmanagementIPAddress:
      title: ocsfv1.3.0groupmanagementIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0groupmanagementMACAddress:
      title: ocsfv1.3.0groupmanagementMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0groupmanagementPort:
      title: ocsfv1.3.0groupmanagementPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0groupmanagementProcessName:
      title: ocsfv1.3.0groupmanagementProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0groupmanagementSubnet:
      title: ocsfv1.3.0groupmanagementSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0groupmanagementTimestamp:
      title: ocsfv1.3.0groupmanagementTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0groupmanagementURLString:
      title: ocsfv1.3.0groupmanagementURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0groupmanagementUserName:
      title: ocsfv1.3.0groupmanagementUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0groupmanagementActivityId:
      title: ocsfv1.3.0groupmanagementActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - AssignPrivileges: Assign privileges to a group.

        2 - RevokePrivileges: Revoke privileges from a group.

        3 - AddUser: Add user to a group.

        4 - RemoveUser: Remove user from a group.

        5 - Delete: A group was deleted.

        6 - Create: A group was created.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementCategoryUid:
      title: ocsfv1.3.0groupmanagementCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        3 - AccessManagement: Identity &amp; Access Management (IAM) events
        relate to the supervision of the system's authentication and access
        control model. Examples of such events are the success or failure of
        authentication, granting of authority, password change, entity change,
        privileged use etc.
    ocsfv1.3.0groupmanagementClassUid:
      title: ocsfv1.3.0groupmanagementClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        3006 - GroupManagement: Group Management events report management
        updates to a group, including updates to membership and permissions.
    ocsfv1.3.0groupmanagementGroupManagement:
      title: ocsfv1.3.0groupmanagementGroupManagement
      type: object
      description: >-
        Group Management events report management updates to a group, including
        updates to membership and permissions.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Identity &amp; Access Management</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        group:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          description: Group that was the target of the event.
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: A list of privileges assigned to the group.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        resource:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementResourceDetails'
          nullable: true
          description: Resource that the privileges give access to.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementNetworkEndpoint'
          nullable: true
          description: Details about the source of the IAM activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: A user that was added to or removed from the group.
      required:
        - activity_id
        - category_uid
        - class_uid
        - group
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0groupmanagementSeverityId:
      title: ocsfv1.3.0groupmanagementSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0groupmanagementStatusId:
      title: ocsfv1.3.0groupmanagementStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0groupmanagementTypeUid:
      title: ocsfv1.3.0groupmanagementTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        300600 - Unknown
        300601 - AssignPrivileges: Assign privileges to a group.
        300602 - RevokePrivileges: Revoke privileges from a group.
        300603 - AddUser: Add user to a group.
        300604 - RemoveUser: Remove user from a group.
        300605 - Delete: A group was deleted.
        300606 - Create: A group was created.
        300699 - Other
    ocsfv1.3.0groupmanagementAccount:
      title: ocsfv1.3.0groupmanagementAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0groupmanagementAccount_TypeId:
      title: ocsfv1.3.0groupmanagementAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0groupmanagementActor:
      title: ocsfv1.3.0groupmanagementActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0groupmanagementActor_ActorTypeId:
      title: ocsfv1.3.0groupmanagementActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementAffectedCode:
      title: ocsfv1.3.0groupmanagementAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0groupmanagementAffectedPackage:
      title: ocsfv1.3.0groupmanagementAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0groupmanagementAffectedPackage_TypeId:
      title: ocsfv1.3.0groupmanagementAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementAgent:
      title: ocsfv1.3.0groupmanagementAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0groupmanagementAgent_TypeId:
      title: ocsfv1.3.0groupmanagementAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementApi:
      title: ocsfv1.3.0groupmanagementApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0groupmanagementAttack:
      title: ocsfv1.3.0groupmanagementAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0groupmanagementAuthorization:
      title: ocsfv1.3.0groupmanagementAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0groupmanagementAutonomousSystem:
      title: ocsfv1.3.0groupmanagementAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0groupmanagementCertificate:
      title: ocsfv1.3.0groupmanagementCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0groupmanagementCloud:
      title: ocsfv1.3.0groupmanagementCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0groupmanagementContainer:
      title: ocsfv1.3.0groupmanagementContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0groupmanagementCve:
      title: ocsfv1.3.0groupmanagementCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0groupmanagementCvss:
      title: ocsfv1.3.0groupmanagementCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0groupmanagementCvss_Depth:
      title: ocsfv1.3.0groupmanagementCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0groupmanagementCwe:
      title: ocsfv1.3.0groupmanagementCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0groupmanagementDevice:
      title: ocsfv1.3.0groupmanagementDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0groupmanagementDevice_NetworkStatusId:
      title: ocsfv1.3.0groupmanagementDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0groupmanagementDevice_RiskLevelId:
      title: ocsfv1.3.0groupmanagementDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0groupmanagementDevice_TypeId:
      title: ocsfv1.3.0groupmanagementDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0groupmanagementDeviceHwInfo:
      title: ocsfv1.3.0groupmanagementDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0groupmanagementDigitalSignature:
      title: ocsfv1.3.0groupmanagementDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0groupmanagementDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0groupmanagementDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0groupmanagementDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0groupmanagementDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0groupmanagementDigitalSignature_StateId:
      title: ocsfv1.3.0groupmanagementDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0groupmanagementDisplay:
      title: ocsfv1.3.0groupmanagementDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0groupmanagementDnsAnswer:
      title: ocsfv1.3.0groupmanagementDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0groupmanagementDnsAnswer_FlagIds:
      title: ocsfv1.3.0groupmanagementDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0groupmanagementDomainContact:
      title: ocsfv1.3.0groupmanagementDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0groupmanagementDomainContact_TypeId:
      title: ocsfv1.3.0groupmanagementDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementEmail:
      title: ocsfv1.3.0groupmanagementEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0groupmanagementEmailAuth:
      title: ocsfv1.3.0groupmanagementEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0groupmanagementEnrichment:
      title: ocsfv1.3.0groupmanagementEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0groupmanagementEpss:
      title: ocsfv1.3.0groupmanagementEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0groupmanagementExtension:
      title: ocsfv1.3.0groupmanagementExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0groupmanagementFeature:
      title: ocsfv1.3.0groupmanagementFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0groupmanagementFile:
      title: ocsfv1.3.0groupmanagementFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0groupmanagementFile_ConfidentialityId:
      title: ocsfv1.3.0groupmanagementFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementFile_TypeId:
      title: ocsfv1.3.0groupmanagementFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementFingerprint:
      title: ocsfv1.3.0groupmanagementFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0groupmanagementFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0groupmanagementFingerprint_AlgorithmId:
      title: ocsfv1.3.0groupmanagementFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0groupmanagementGroup:
      title: ocsfv1.3.0groupmanagementGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0groupmanagementHttpHeader:
      title: ocsfv1.3.0groupmanagementHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0groupmanagementHttpRequest:
      title: ocsfv1.3.0groupmanagementHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0groupmanagementHttpRequest_HttpMethod:
      title: ocsfv1.3.0groupmanagementHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0groupmanagementIdp:
      title: ocsfv1.3.0groupmanagementIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0groupmanagementImage:
      title: ocsfv1.3.0groupmanagementImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0groupmanagementKbArticle:
      title: ocsfv1.3.0groupmanagementKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0groupmanagementKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0groupmanagementKbArticle_InstallStateId:
      title: ocsfv1.3.0groupmanagementKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementKeyboardInfo:
      title: ocsfv1.3.0groupmanagementKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0groupmanagementKillChainPhase:
      title: ocsfv1.3.0groupmanagementKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0groupmanagementKillChainPhase_PhaseId:
      title: ocsfv1.3.0groupmanagementKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0groupmanagementLdapPerson:
      title: ocsfv1.3.0groupmanagementLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0groupmanagementLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0groupmanagementLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0groupmanagementLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementLocation:
      title: ocsfv1.3.0groupmanagementLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0groupmanagementLogger:
      title: ocsfv1.3.0groupmanagementLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0groupmanagementMetadata:
      title: ocsfv1.3.0groupmanagementMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0groupmanagementMetric:
      title: ocsfv1.3.0groupmanagementMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0groupmanagementNetworkEndpoint:
      title: ocsfv1.3.0groupmanagementNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0groupmanagementNetworkEndpoint_TypeId:
      title: ocsfv1.3.0groupmanagementNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0groupmanagementNetworkInterface:
      title: ocsfv1.3.0groupmanagementNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0groupmanagementNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0groupmanagementNetworkInterface_TypeId:
      title: ocsfv1.3.0groupmanagementNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementNetworkProxy:
      title: ocsfv1.3.0groupmanagementNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0groupmanagementNetworkProxy_TypeId:
      title: ocsfv1.3.0groupmanagementNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0groupmanagementObject:
      title: ocsfv1.3.0groupmanagementObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0groupmanagementObservable:
      title: ocsfv1.3.0groupmanagementObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0groupmanagementObservable_TypeId:
      title: ocsfv1.3.0groupmanagementObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0groupmanagementOrganization:
      title: ocsfv1.3.0groupmanagementOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0groupmanagementOs:
      title: ocsfv1.3.0groupmanagementOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0groupmanagementOs_TypeId:
      title: ocsfv1.3.0groupmanagementOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0groupmanagementOsint:
      title: ocsfv1.3.0groupmanagementOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0groupmanagementOsint_ConfidenceId:
      title: ocsfv1.3.0groupmanagementOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementOsint_Tlp:
      title: ocsfv1.3.0groupmanagementOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0groupmanagementOsint_TypeId:
      title: ocsfv1.3.0groupmanagementOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0groupmanagementPackage:
      title: ocsfv1.3.0groupmanagementPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0groupmanagementPackage_TypeId:
      title: ocsfv1.3.0groupmanagementPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementPolicy:
      title: ocsfv1.3.0groupmanagementPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0groupmanagementProcess:
      title: ocsfv1.3.0groupmanagementProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0groupmanagementProcess_IntegrityId:
      title: ocsfv1.3.0groupmanagementProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0groupmanagementProduct:
      title: ocsfv1.3.0groupmanagementProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0groupmanagementRemediation:
      title: ocsfv1.3.0groupmanagementRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0groupmanagementReputation:
      title: ocsfv1.3.0groupmanagementReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0groupmanagementReputation_ScoreId:
      title: ocsfv1.3.0groupmanagementReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0groupmanagementRequest:
      title: ocsfv1.3.0groupmanagementRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0groupmanagementResourceDetails:
      title: ocsfv1.3.0groupmanagementResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0groupmanagementResponse:
      title: ocsfv1.3.0groupmanagementResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0groupmanagementService:
      title: ocsfv1.3.0groupmanagementService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0groupmanagementSession:
      title: ocsfv1.3.0groupmanagementSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0groupmanagementSubTechnique:
      title: ocsfv1.3.0groupmanagementSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0groupmanagementTactic:
      title: ocsfv1.3.0groupmanagementTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0groupmanagementTechnique:
      title: ocsfv1.3.0groupmanagementTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0groupmanagementTimespan:
      title: ocsfv1.3.0groupmanagementTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0groupmanagementTimespan_TypeId:
      title: ocsfv1.3.0groupmanagementTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementUrl:
      title: ocsfv1.3.0groupmanagementUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0groupmanagementUrl_CategoryIds:
      title: ocsfv1.3.0groupmanagementUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0groupmanagementUser:
      title: ocsfv1.3.0groupmanagementUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0groupmanagementUser_MfaStatusId:
      title: ocsfv1.3.0groupmanagementUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementUser_RiskLevelId:
      title: ocsfv1.3.0groupmanagementUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0groupmanagementUser_TypeId:
      title: ocsfv1.3.0groupmanagementUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0groupmanagementUser_UserStatusId:
      title: ocsfv1.3.0groupmanagementUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0groupmanagementVulnerability:
      title: ocsfv1.3.0groupmanagementVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0groupmanagementWhois:
      title: ocsfv1.3.0groupmanagementWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0groupmanagementDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0groupmanagementSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0groupmanagementWhois_DnssecStatusId:
      title: ocsfv1.3.0groupmanagementWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingEmailAddress:
      title: ocsfv1.3.0incidentfindingEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0incidentfindingFileName:
      title: ocsfv1.3.0incidentfindingFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0incidentfindingHash:
      title: ocsfv1.3.0incidentfindingHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0incidentfindingHostname:
      title: ocsfv1.3.0incidentfindingHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0incidentfindingIPAddress:
      title: ocsfv1.3.0incidentfindingIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0incidentfindingMACAddress:
      title: ocsfv1.3.0incidentfindingMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0incidentfindingPort:
      title: ocsfv1.3.0incidentfindingPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0incidentfindingSubnet:
      title: ocsfv1.3.0incidentfindingSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0incidentfindingTimestamp:
      title: ocsfv1.3.0incidentfindingTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0incidentfindingURLString:
      title: ocsfv1.3.0incidentfindingURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0incidentfindingUserName:
      title: ocsfv1.3.0incidentfindingUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0incidentfindingActivityId:
      title: ocsfv1.3.0incidentfindingActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: Reports the creation of an Incident.

        2 - Update: Reports updates to an Incident.

        3 - Close: Reports closure of an Incident .

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingCategoryUid:
      title: ocsfv1.3.0incidentfindingCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        2 - Findings: Findings events report findings, detections, and possible
        resolutions of malware, anomalies, or other actions performed by
        security products.
    ocsfv1.3.0incidentfindingClassUid:
      title: ocsfv1.3.0incidentfindingClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        2005 - IncidentFinding: An Incident Finding reports the creation,
        update, or closure of security incidents as a result of detections
        and/or analytics.
    ocsfv1.3.0incidentfindingConfidenceId:
      title: ocsfv1.3.0incidentfindingConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingImpactId:
      title: ocsfv1.3.0incidentfindingImpactId
      type: integer
      description: >-
        ImpactId is an enum, and the following values are allowed.

        0 - Unknown: The normalized impact is unknown.

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The impact is not mapped. See the <code>impact</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0incidentfindingIncidentFinding:
      title: ocsfv1.3.0incidentfindingIncidentFinding
      type: object
      description: >-
        An Incident Finding reports the creation, update, or closure of security
        incidents as a result of detections and/or analytics.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingActivityId'
          description: The normalized identifier of the Incident activity.
        activity_name:
          type: string
          nullable: true
          description: >-
            The Incident activity name, as defined by the
            <code>activity_id</code>.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        assignee:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: The details of the user assigned to an Incident.
        assignee_group:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingGroup'
          nullable: true
          description: The details of the group assigned to an Incident.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques associated to the Incident.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Findings</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        comment:
          type: string
          nullable: true
          description: >-
            Additional user supplied details for updating or closing the
            incident.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObject'
          nullable: true
          description: A list of custom fields
        desc:
          type: string
          nullable: true
          description: The short description of the Incident.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time of the most recent event included in the incident.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the most recent event included in the incident.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        finding_info_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFindingInfo'
          description: >-
            A list of <code>finding_info</code> objects associated to an
            incident.
        impact:
          type: string
          nullable: true
          description: >-
            The impact , normalized to the caption of the impact_id value. In
            the case of 'Other', it is defined by the event source.
        impact_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingImpactId'
          nullable: true
          description: The normalized impact of the finding.
        impact_score:
          type: integer
          nullable: true
          description: The impact of the finding, valid range 0-100.
        is_suspected_breach:
          type: boolean
          nullable: true
          description: >-
            A determination based on analytics as to whether a potential breach
            was found.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        priority:
          type: string
          nullable: true
          description: >-
            The priority, normalized to the caption of the priority_id value. In
            the case of 'Other', it is defined by the event source.
        priority_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingPriorityId'
          nullable: true
          description: >-
            The normalized priority. Priority identifies the relative importance
            of the finding. It is a measurement of urgency.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: A Url link used to access the original incident.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time of the least recent event included in the incident.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the least recent event included in the incident.
        status:
          type: string
          nullable: true
          description: >-
            The normalized status of the Incident normalized to the caption of
            the status_id value. In the case of 'Other', it is defined by the
            source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingStatusId'
          description: The normalized status identifier of the Incident.
        ticket:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTicket'
          nullable: true
          description: The linked ticket in the ticketing system.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        verdict:
          type: string
          nullable: true
          description: The verdict assigned to an Incident finding.
        verdict_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingVerdictId'
          nullable: true
          description: The normalized verdict of an Incident.
      required:
        - activity_id
        - category_uid
        - class_uid
        - finding_info_list
        - metadata
        - severity_id
        - status_id
        - time
        - type_uid
    ocsfv1.3.0incidentfindingPriorityId:
      title: ocsfv1.3.0incidentfindingPriorityId
      type: integer
      description: >-
        PriorityId is an enum, and the following values are allowed.

        0 - Unknown: No priority is assigned.

        1 - Low: Application or personal procedure is unusable, where a
        workaround is available or a repair is possible.

        2 - Medium: Non-critical function or procedure is unusable or hard to
        use causing operational disruptions with no direct impact on a service's
        availability. A workaround is available.

        3 - High: Critical functionality or network access is interrupted,
        degraded or unusable, having a severe impact on services availability.
        No acceptable alternative is possible.

        4 - Critical: Interruption making a critical functionality inaccessible
        or a complete network interruption causing a severe impact on services
        availability. There is no possible alternative.

        99 - Other: The priority is not normalized.
    ocsfv1.3.0incidentfindingSeverityId:
      title: ocsfv1.3.0incidentfindingSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0incidentfindingStatusId:
      title: ocsfv1.3.0incidentfindingStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - New: The service desk has received the incident but has not assigned
        it to an agent.

        2 - InProgress: The incident has been assigned to an agent but has not
        been resolved. The agent is actively working with the user to diagnose
        and resolve the incident.

        3 - OnHold: The incident requires some information or response from the
        user or from a third party.

        4 - Resolved: The service desk has confirmed that the incident is
        resolved.

        5 - Closed: The incident is resolved and no further action is necessary.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0incidentfindingTypeUid:
      title: ocsfv1.3.0incidentfindingTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        200500 - Unknown
        200501 - Create: Reports the creation of an Incident.
        200502 - Update: Reports updates to an Incident.
        200503 - Close: Reports closure of an Incident .
        200599 - Other
    ocsfv1.3.0incidentfindingVerdictId:
      title: ocsfv1.3.0incidentfindingVerdictId
      type: integer
      description: >-
        VerdictId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - FalsePositive: The incident is a false positive.

        2 - TruePositive: The incident is a true positive.

        3 - Disregard: The incident can be disregarded as it is unimportant, an
        error or accident.

        4 - Suspicious: The incident is suspicious.

        5 - Benign: The incident is benign.

        6 - Test: The incident is a test.

        7 - InsufficientData: The incident has insufficient data to make a
        verdict.

        8 - SecurityRisk: The incident is a security risk.

        9 - ManagedExternally: The incident remediation or required actions are
        managed externally.

        10 - Duplicate: The incident is a duplicate.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingAccount:
      title: ocsfv1.3.0incidentfindingAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0incidentfindingAccount_TypeId:
      title: ocsfv1.3.0incidentfindingAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0incidentfindingAffectedCode:
      title: ocsfv1.3.0incidentfindingAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0incidentfindingAffectedPackage:
      title: ocsfv1.3.0incidentfindingAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0incidentfindingAffectedPackage_TypeId:
      title: ocsfv1.3.0incidentfindingAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingAgent:
      title: ocsfv1.3.0incidentfindingAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0incidentfindingAgent_TypeId:
      title: ocsfv1.3.0incidentfindingAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingAnalytic:
      title: ocsfv1.3.0incidentfindingAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObject'
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.3.0incidentfindingAnalytic_TypeId:
      title: ocsfv1.3.0incidentfindingAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingApi:
      title: ocsfv1.3.0incidentfindingApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0incidentfindingAttack:
      title: ocsfv1.3.0incidentfindingAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0incidentfindingAutonomousSystem:
      title: ocsfv1.3.0incidentfindingAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0incidentfindingCertificate:
      title: ocsfv1.3.0incidentfindingCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0incidentfindingCloud:
      title: ocsfv1.3.0incidentfindingCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0incidentfindingContainer:
      title: ocsfv1.3.0incidentfindingContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0incidentfindingCve:
      title: ocsfv1.3.0incidentfindingCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0incidentfindingCvss:
      title: ocsfv1.3.0incidentfindingCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0incidentfindingCvss_Depth:
      title: ocsfv1.3.0incidentfindingCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0incidentfindingCwe:
      title: ocsfv1.3.0incidentfindingCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0incidentfindingDevice:
      title: ocsfv1.3.0incidentfindingDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0incidentfindingDevice_NetworkStatusId:
      title: ocsfv1.3.0incidentfindingDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0incidentfindingDevice_RiskLevelId:
      title: ocsfv1.3.0incidentfindingDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0incidentfindingDevice_TypeId:
      title: ocsfv1.3.0incidentfindingDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0incidentfindingDeviceHwInfo:
      title: ocsfv1.3.0incidentfindingDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0incidentfindingDigitalSignature:
      title: ocsfv1.3.0incidentfindingDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0incidentfindingDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0incidentfindingDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0incidentfindingDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0incidentfindingDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0incidentfindingDigitalSignature_StateId:
      title: ocsfv1.3.0incidentfindingDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0incidentfindingDisplay:
      title: ocsfv1.3.0incidentfindingDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0incidentfindingDnsAnswer:
      title: ocsfv1.3.0incidentfindingDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0incidentfindingDnsAnswer_FlagIds:
      title: ocsfv1.3.0incidentfindingDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0incidentfindingDomainContact:
      title: ocsfv1.3.0incidentfindingDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0incidentfindingDomainContact_TypeId:
      title: ocsfv1.3.0incidentfindingDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingEmail:
      title: ocsfv1.3.0incidentfindingEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0incidentfindingEmailAuth:
      title: ocsfv1.3.0incidentfindingEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0incidentfindingEnrichment:
      title: ocsfv1.3.0incidentfindingEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0incidentfindingEpss:
      title: ocsfv1.3.0incidentfindingEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0incidentfindingExtension:
      title: ocsfv1.3.0incidentfindingExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0incidentfindingFeature:
      title: ocsfv1.3.0incidentfindingFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0incidentfindingFile:
      title: ocsfv1.3.0incidentfindingFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0incidentfindingFile_ConfidentialityId:
      title: ocsfv1.3.0incidentfindingFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingFile_TypeId:
      title: ocsfv1.3.0incidentfindingFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingFindingInfo:
      title: ocsfv1.3.0incidentfindingFindingInfo
      type: object
      description: >-
        The Finding Information object describes metadata related to a security
        finding generated by a security tool or system.
      properties:
        analytic:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAnalytic'
          nullable: true
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAttack'
          nullable: true
          description: >-
            The <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> technique and associated tactics related to the
            finding.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was created.
        data_sources:
          type: array
          items:
            type: string
          nullable: true
          description: A list of data sources utilized in generation of the finding.
        desc:
          type: string
          nullable: true
          description: The description of the reported finding.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was last modified.
        product_uid:
          type: string
          nullable: true
          description: The unique identifier of the product that reported the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAnalytic'
          nullable: true
          description: Other analytics related to this finding.
        related_events:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingRelatedEvent'
          nullable: true
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: The URL pointing to the source of the finding.
        title:
          type: string
          description: A title or a brief phrase summarizing the reported finding.
        types:
          type: array
          items:
            type: string
          nullable: true
          description: One or more types of the reported finding.
        uid:
          type: string
          description: The unique identifier of the reported finding.
      required:
        - title
        - uid
    ocsfv1.3.0incidentfindingFingerprint:
      title: ocsfv1.3.0incidentfindingFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0incidentfindingFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0incidentfindingFingerprint_AlgorithmId:
      title: ocsfv1.3.0incidentfindingFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0incidentfindingGroup:
      title: ocsfv1.3.0incidentfindingGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0incidentfindingImage:
      title: ocsfv1.3.0incidentfindingImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0incidentfindingKbArticle:
      title: ocsfv1.3.0incidentfindingKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0incidentfindingKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0incidentfindingKbArticle_InstallStateId:
      title: ocsfv1.3.0incidentfindingKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingKeyboardInfo:
      title: ocsfv1.3.0incidentfindingKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0incidentfindingKillChainPhase:
      title: ocsfv1.3.0incidentfindingKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0incidentfindingKillChainPhase_PhaseId:
      title: ocsfv1.3.0incidentfindingKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0incidentfindingLdapPerson:
      title: ocsfv1.3.0incidentfindingLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0incidentfindingLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0incidentfindingLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0incidentfindingLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingLocation:
      title: ocsfv1.3.0incidentfindingLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0incidentfindingLogger:
      title: ocsfv1.3.0incidentfindingLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0incidentfindingMetadata:
      title: ocsfv1.3.0incidentfindingMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0incidentfindingMetric:
      title: ocsfv1.3.0incidentfindingMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0incidentfindingNetworkInterface:
      title: ocsfv1.3.0incidentfindingNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0incidentfindingNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0incidentfindingNetworkInterface_TypeId:
      title: ocsfv1.3.0incidentfindingNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingObject:
      title: ocsfv1.3.0incidentfindingObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0incidentfindingObservable:
      title: ocsfv1.3.0incidentfindingObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0incidentfindingObservable_TypeId:
      title: ocsfv1.3.0incidentfindingObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0incidentfindingOrganization:
      title: ocsfv1.3.0incidentfindingOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0incidentfindingOs:
      title: ocsfv1.3.0incidentfindingOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0incidentfindingOs_TypeId:
      title: ocsfv1.3.0incidentfindingOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0incidentfindingOsint:
      title: ocsfv1.3.0incidentfindingOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0incidentfindingOsint_ConfidenceId:
      title: ocsfv1.3.0incidentfindingOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingOsint_Tlp:
      title: ocsfv1.3.0incidentfindingOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0incidentfindingOsint_TypeId:
      title: ocsfv1.3.0incidentfindingOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0incidentfindingPackage:
      title: ocsfv1.3.0incidentfindingPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0incidentfindingPackage_TypeId:
      title: ocsfv1.3.0incidentfindingPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingProduct:
      title: ocsfv1.3.0incidentfindingProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0incidentfindingRelatedEvent:
      title: ocsfv1.3.0incidentfindingRelatedEvent
      type: object
      description: The Related Event object describes an OCSF event related to a finding.
      properties:
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        product_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the product that reported the related
            event.
        type:
          type: string
          nullable: true
          description: >-
            The type of the related event, as defined by <code>type_uid</code>.
            <p>For example: <code>Process Activity: Launch.</code></p>
        type_name:
          type: string
          nullable: true
          description: >-
            The type of the related OCSF event, as defined by
            <code>type_uid</code>. <p>For example: <code>Process Activity:
            Launch.</code></p>
        type_uid:
          type: integer
          nullable: true
          description: >-
            The unique identifier of the related OCSF event type. <p>For
            example: <code>100701.</code></p>
        uid:
          type: string
          description: >-
            The unique identifier of the related OCSF event. This value must be
            equal to <code>metadata.uid</code> in the corresponding related
            event.
      required:
        - uid
    ocsfv1.3.0incidentfindingRemediation:
      title: ocsfv1.3.0incidentfindingRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0incidentfindingReputation:
      title: ocsfv1.3.0incidentfindingReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0incidentfindingReputation_ScoreId:
      title: ocsfv1.3.0incidentfindingReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0incidentfindingRequest:
      title: ocsfv1.3.0incidentfindingRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0incidentfindingResponse:
      title: ocsfv1.3.0incidentfindingResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0incidentfindingService:
      title: ocsfv1.3.0incidentfindingService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0incidentfindingSubTechnique:
      title: ocsfv1.3.0incidentfindingSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0incidentfindingTactic:
      title: ocsfv1.3.0incidentfindingTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0incidentfindingTechnique:
      title: ocsfv1.3.0incidentfindingTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0incidentfindingTicket:
      title: ocsfv1.3.0incidentfindingTicket
      type: object
      description: >-
        The Ticket object represents ticket in the customer's systems like
        Salesforce, jira etc.
      properties:
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: The url of a ticket in the ticket system.
        title:
          type: string
          nullable: true
          description: The title of the ticket.
        type:
          type: string
          nullable: true
          description: >-
            The linked ticket type determines whether the ticket is internal or
            in an external ticketing system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTicket_TypeId'
          nullable: true
          description: The normalized identifier for the ticket type.
        uid:
          type: string
          nullable: true
          description: Unique ticket identifier like ticket id.
    ocsfv1.3.0incidentfindingTicket_TypeId:
      title: ocsfv1.3.0incidentfindingTicket_TypeId
      type: integer
      description: >-
        TicketTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Internal

        2 - External

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingTimespan:
      title: ocsfv1.3.0incidentfindingTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0incidentfindingTimespan_TypeId:
      title: ocsfv1.3.0incidentfindingTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingUrl:
      title: ocsfv1.3.0incidentfindingUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0incidentfindingUrl_CategoryIds:
      title: ocsfv1.3.0incidentfindingUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0incidentfindingUser:
      title: ocsfv1.3.0incidentfindingUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0incidentfindingUser_MfaStatusId:
      title: ocsfv1.3.0incidentfindingUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingUser_RiskLevelId:
      title: ocsfv1.3.0incidentfindingUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0incidentfindingUser_TypeId:
      title: ocsfv1.3.0incidentfindingUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0incidentfindingUser_UserStatusId:
      title: ocsfv1.3.0incidentfindingUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0incidentfindingVulnerability:
      title: ocsfv1.3.0incidentfindingVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0incidentfindingWhois:
      title: ocsfv1.3.0incidentfindingWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0incidentfindingDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0incidentfindingSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0incidentfindingWhois_DnssecStatusId:
      title: ocsfv1.3.0incidentfindingWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoEmailAddress:
      title: ocsfv1.3.0inventoryinfoEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0inventoryinfoFileName:
      title: ocsfv1.3.0inventoryinfoFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0inventoryinfoHash:
      title: ocsfv1.3.0inventoryinfoHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0inventoryinfoHostname:
      title: ocsfv1.3.0inventoryinfoHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0inventoryinfoIPAddress:
      title: ocsfv1.3.0inventoryinfoIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0inventoryinfoMACAddress:
      title: ocsfv1.3.0inventoryinfoMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0inventoryinfoPort:
      title: ocsfv1.3.0inventoryinfoPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0inventoryinfoProcessName:
      title: ocsfv1.3.0inventoryinfoProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0inventoryinfoSubnet:
      title: ocsfv1.3.0inventoryinfoSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0inventoryinfoTimestamp:
      title: ocsfv1.3.0inventoryinfoTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0inventoryinfoURLString:
      title: ocsfv1.3.0inventoryinfoURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0inventoryinfoUserName:
      title: ocsfv1.3.0inventoryinfoUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0inventoryinfoActivityId:
      title: ocsfv1.3.0inventoryinfoActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Log: The discovered information is via a log.

        2 - Collect: The discovered information is via a collection process.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoCategoryUid:
      title: ocsfv1.3.0inventoryinfoCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        5 - Discovery: Discovery events report the existence and state of
        devices, files, configurations, processes, registry keys, and other
        objects.
    ocsfv1.3.0inventoryinfoClassUid:
      title: ocsfv1.3.0inventoryinfoClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        5001 - DeviceInventoryInfo: Device Inventory Info events report device
        inventory data that is either logged or proactively collected. For
        example, when collecting device information from a CMDB or running a
        network sweep of connected devices.
    ocsfv1.3.0inventoryinfoInventoryInfo:
      title: ocsfv1.3.0inventoryinfoInventoryInfo
      type: object
      description: >-
        Device Inventory Info events report device inventory data that is either
        logged or proactively collected. For example, when collecting device
        information from a CMDB or running a network sweep of connected devices.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Discovery</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDevice'
          description: The device that is being discovered by an inventory process.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - device
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0inventoryinfoSeverityId:
      title: ocsfv1.3.0inventoryinfoSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0inventoryinfoStatusId:
      title: ocsfv1.3.0inventoryinfoStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0inventoryinfoTypeUid:
      title: ocsfv1.3.0inventoryinfoTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        500100 - Unknown

        500101 - Log: The discovered information is via a log.

        500102 - Collect: The discovered information is via a collection
        process.

        500199 - Other
    ocsfv1.3.0inventoryinfoAccount:
      title: ocsfv1.3.0inventoryinfoAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0inventoryinfoAccount_TypeId:
      title: ocsfv1.3.0inventoryinfoAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0inventoryinfoActor:
      title: ocsfv1.3.0inventoryinfoActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0inventoryinfoActor_ActorTypeId:
      title: ocsfv1.3.0inventoryinfoActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoAffectedCode:
      title: ocsfv1.3.0inventoryinfoAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0inventoryinfoAffectedPackage:
      title: ocsfv1.3.0inventoryinfoAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0inventoryinfoAffectedPackage_TypeId:
      title: ocsfv1.3.0inventoryinfoAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoAgent:
      title: ocsfv1.3.0inventoryinfoAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0inventoryinfoAgent_TypeId:
      title: ocsfv1.3.0inventoryinfoAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoApi:
      title: ocsfv1.3.0inventoryinfoApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0inventoryinfoAttack:
      title: ocsfv1.3.0inventoryinfoAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0inventoryinfoAuthorization:
      title: ocsfv1.3.0inventoryinfoAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0inventoryinfoAutonomousSystem:
      title: ocsfv1.3.0inventoryinfoAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0inventoryinfoCertificate:
      title: ocsfv1.3.0inventoryinfoCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0inventoryinfoCloud:
      title: ocsfv1.3.0inventoryinfoCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0inventoryinfoContainer:
      title: ocsfv1.3.0inventoryinfoContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0inventoryinfoCve:
      title: ocsfv1.3.0inventoryinfoCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0inventoryinfoCvss:
      title: ocsfv1.3.0inventoryinfoCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0inventoryinfoCvss_Depth:
      title: ocsfv1.3.0inventoryinfoCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0inventoryinfoCwe:
      title: ocsfv1.3.0inventoryinfoCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0inventoryinfoDevice:
      title: ocsfv1.3.0inventoryinfoDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0inventoryinfoDevice_NetworkStatusId:
      title: ocsfv1.3.0inventoryinfoDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0inventoryinfoDevice_RiskLevelId:
      title: ocsfv1.3.0inventoryinfoDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0inventoryinfoDevice_TypeId:
      title: ocsfv1.3.0inventoryinfoDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0inventoryinfoDeviceHwInfo:
      title: ocsfv1.3.0inventoryinfoDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0inventoryinfoDigitalSignature:
      title: ocsfv1.3.0inventoryinfoDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0inventoryinfoDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0inventoryinfoDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0inventoryinfoDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0inventoryinfoDigitalSignature_StateId:
      title: ocsfv1.3.0inventoryinfoDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0inventoryinfoDisplay:
      title: ocsfv1.3.0inventoryinfoDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0inventoryinfoDnsAnswer:
      title: ocsfv1.3.0inventoryinfoDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0inventoryinfoDnsAnswer_FlagIds:
      title: ocsfv1.3.0inventoryinfoDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0inventoryinfoDomainContact:
      title: ocsfv1.3.0inventoryinfoDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0inventoryinfoDomainContact_TypeId:
      title: ocsfv1.3.0inventoryinfoDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoEmail:
      title: ocsfv1.3.0inventoryinfoEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0inventoryinfoEmailAuth:
      title: ocsfv1.3.0inventoryinfoEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0inventoryinfoEnrichment:
      title: ocsfv1.3.0inventoryinfoEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0inventoryinfoEpss:
      title: ocsfv1.3.0inventoryinfoEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0inventoryinfoExtension:
      title: ocsfv1.3.0inventoryinfoExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0inventoryinfoFeature:
      title: ocsfv1.3.0inventoryinfoFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0inventoryinfoFile:
      title: ocsfv1.3.0inventoryinfoFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0inventoryinfoFile_ConfidentialityId:
      title: ocsfv1.3.0inventoryinfoFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoFile_TypeId:
      title: ocsfv1.3.0inventoryinfoFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoFingerprint:
      title: ocsfv1.3.0inventoryinfoFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0inventoryinfoFingerprint_AlgorithmId:
      title: ocsfv1.3.0inventoryinfoFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0inventoryinfoGroup:
      title: ocsfv1.3.0inventoryinfoGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0inventoryinfoIdp:
      title: ocsfv1.3.0inventoryinfoIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0inventoryinfoImage:
      title: ocsfv1.3.0inventoryinfoImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0inventoryinfoKbArticle:
      title: ocsfv1.3.0inventoryinfoKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0inventoryinfoKbArticle_InstallStateId:
      title: ocsfv1.3.0inventoryinfoKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoKeyboardInfo:
      title: ocsfv1.3.0inventoryinfoKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0inventoryinfoKillChainPhase:
      title: ocsfv1.3.0inventoryinfoKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0inventoryinfoKillChainPhase_PhaseId:
      title: ocsfv1.3.0inventoryinfoKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0inventoryinfoLdapPerson:
      title: ocsfv1.3.0inventoryinfoLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0inventoryinfoLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0inventoryinfoLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0inventoryinfoLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoLocation:
      title: ocsfv1.3.0inventoryinfoLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0inventoryinfoLogger:
      title: ocsfv1.3.0inventoryinfoLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0inventoryinfoMetadata:
      title: ocsfv1.3.0inventoryinfoMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0inventoryinfoMetric:
      title: ocsfv1.3.0inventoryinfoMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0inventoryinfoNetworkInterface:
      title: ocsfv1.3.0inventoryinfoNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0inventoryinfoNetworkInterface_TypeId:
      title: ocsfv1.3.0inventoryinfoNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoObject:
      title: ocsfv1.3.0inventoryinfoObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0inventoryinfoObservable:
      title: ocsfv1.3.0inventoryinfoObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0inventoryinfoObservable_TypeId:
      title: ocsfv1.3.0inventoryinfoObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0inventoryinfoOrganization:
      title: ocsfv1.3.0inventoryinfoOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0inventoryinfoOs:
      title: ocsfv1.3.0inventoryinfoOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0inventoryinfoOs_TypeId:
      title: ocsfv1.3.0inventoryinfoOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0inventoryinfoOsint:
      title: ocsfv1.3.0inventoryinfoOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0inventoryinfoOsint_ConfidenceId:
      title: ocsfv1.3.0inventoryinfoOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoOsint_Tlp:
      title: ocsfv1.3.0inventoryinfoOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0inventoryinfoOsint_TypeId:
      title: ocsfv1.3.0inventoryinfoOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0inventoryinfoPackage:
      title: ocsfv1.3.0inventoryinfoPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0inventoryinfoPackage_TypeId:
      title: ocsfv1.3.0inventoryinfoPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoPolicy:
      title: ocsfv1.3.0inventoryinfoPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0inventoryinfoProcess:
      title: ocsfv1.3.0inventoryinfoProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0inventoryinfoProcess_IntegrityId:
      title: ocsfv1.3.0inventoryinfoProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0inventoryinfoProduct:
      title: ocsfv1.3.0inventoryinfoProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0inventoryinfoRemediation:
      title: ocsfv1.3.0inventoryinfoRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0inventoryinfoReputation:
      title: ocsfv1.3.0inventoryinfoReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0inventoryinfoReputation_ScoreId:
      title: ocsfv1.3.0inventoryinfoReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0inventoryinfoRequest:
      title: ocsfv1.3.0inventoryinfoRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0inventoryinfoResponse:
      title: ocsfv1.3.0inventoryinfoResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0inventoryinfoService:
      title: ocsfv1.3.0inventoryinfoService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0inventoryinfoSession:
      title: ocsfv1.3.0inventoryinfoSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0inventoryinfoSubTechnique:
      title: ocsfv1.3.0inventoryinfoSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0inventoryinfoTactic:
      title: ocsfv1.3.0inventoryinfoTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0inventoryinfoTechnique:
      title: ocsfv1.3.0inventoryinfoTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0inventoryinfoTimespan:
      title: ocsfv1.3.0inventoryinfoTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0inventoryinfoTimespan_TypeId:
      title: ocsfv1.3.0inventoryinfoTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoUrl:
      title: ocsfv1.3.0inventoryinfoUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0inventoryinfoUrl_CategoryIds:
      title: ocsfv1.3.0inventoryinfoUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0inventoryinfoUser:
      title: ocsfv1.3.0inventoryinfoUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0inventoryinfoUser_MfaStatusId:
      title: ocsfv1.3.0inventoryinfoUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoUser_RiskLevelId:
      title: ocsfv1.3.0inventoryinfoUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0inventoryinfoUser_TypeId:
      title: ocsfv1.3.0inventoryinfoUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0inventoryinfoUser_UserStatusId:
      title: ocsfv1.3.0inventoryinfoUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0inventoryinfoVulnerability:
      title: ocsfv1.3.0inventoryinfoVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0inventoryinfoWhois:
      title: ocsfv1.3.0inventoryinfoWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0inventoryinfoWhois_DnssecStatusId:
      title: ocsfv1.3.0inventoryinfoWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityEmailAddress:
      title: ocsfv1.3.0moduleactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0moduleactivityFileName:
      title: ocsfv1.3.0moduleactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0moduleactivityHash:
      title: ocsfv1.3.0moduleactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0moduleactivityHostname:
      title: ocsfv1.3.0moduleactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0moduleactivityIPAddress:
      title: ocsfv1.3.0moduleactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0moduleactivityMACAddress:
      title: ocsfv1.3.0moduleactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0moduleactivityPort:
      title: ocsfv1.3.0moduleactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0moduleactivityProcessName:
      title: ocsfv1.3.0moduleactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0moduleactivitySubnet:
      title: ocsfv1.3.0moduleactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0moduleactivityTimestamp:
      title: ocsfv1.3.0moduleactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0moduleactivityURLString:
      title: ocsfv1.3.0moduleactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0moduleactivityUserName:
      title: ocsfv1.3.0moduleactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0moduleactivityActionId:
      title: ocsfv1.3.0moduleactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityActivityId:
      title: ocsfv1.3.0moduleactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Load

        2 - Unload

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityCategoryUid:
      title: ocsfv1.3.0moduleactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        1 - SystemActivity: System Activity events.
    ocsfv1.3.0moduleactivityClassUid:
      title: ocsfv1.3.0moduleactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        1005 - ModuleActivity: Module Activity events report when a process
        loads or unloads the <code>module</code>.
    ocsfv1.3.0moduleactivityDispositionId:
      title: ocsfv1.3.0moduleactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityModuleActivity:
      title: ocsfv1.3.0moduleactivityModuleActivity
      type: object
      description: >-
        Module Activity events report when a process loads or unloads the
        <code>module</code>.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityActor'
          description: The actor that loaded or unloaded the <code>module</code>.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>System Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDevice'
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityMetadata'
          description: The metadata associated with the event or a finding.
        module:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityModule'
          description: The module that was loaded or unloaded.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - actor
        - category_uid
        - class_uid
        - device
        - metadata
        - module
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0moduleactivitySeverityId:
      title: ocsfv1.3.0moduleactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0moduleactivityStatusId:
      title: ocsfv1.3.0moduleactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityTypeUid:
      title: ocsfv1.3.0moduleactivityTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        100500 - Unknown
        100501 - Load
        100502 - Unload
        100599 - Other
    ocsfv1.3.0moduleactivityAccount:
      title: ocsfv1.3.0moduleactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0moduleactivityAccount_TypeId:
      title: ocsfv1.3.0moduleactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0moduleactivityActor:
      title: ocsfv1.3.0moduleactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0moduleactivityActor_ActorTypeId:
      title: ocsfv1.3.0moduleactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityAffectedCode:
      title: ocsfv1.3.0moduleactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0moduleactivityAffectedPackage:
      title: ocsfv1.3.0moduleactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0moduleactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0moduleactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityAgent:
      title: ocsfv1.3.0moduleactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0moduleactivityAgent_TypeId:
      title: ocsfv1.3.0moduleactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityApi:
      title: ocsfv1.3.0moduleactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0moduleactivityAttack:
      title: ocsfv1.3.0moduleactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0moduleactivityAuthorization:
      title: ocsfv1.3.0moduleactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0moduleactivityAutonomousSystem:
      title: ocsfv1.3.0moduleactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0moduleactivityCertificate:
      title: ocsfv1.3.0moduleactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0moduleactivityCloud:
      title: ocsfv1.3.0moduleactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0moduleactivityContainer:
      title: ocsfv1.3.0moduleactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0moduleactivityCve:
      title: ocsfv1.3.0moduleactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0moduleactivityCvss:
      title: ocsfv1.3.0moduleactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0moduleactivityCvss_Depth:
      title: ocsfv1.3.0moduleactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0moduleactivityCwe:
      title: ocsfv1.3.0moduleactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0moduleactivityDevice:
      title: ocsfv1.3.0moduleactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0moduleactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0moduleactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0moduleactivityDevice_RiskLevelId:
      title: ocsfv1.3.0moduleactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0moduleactivityDevice_TypeId:
      title: ocsfv1.3.0moduleactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0moduleactivityDeviceHwInfo:
      title: ocsfv1.3.0moduleactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0moduleactivityDigitalSignature:
      title: ocsfv1.3.0moduleactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0moduleactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0moduleactivityDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0moduleactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0moduleactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityDigitalSignature_StateId:
      title: ocsfv1.3.0moduleactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityDisplay:
      title: ocsfv1.3.0moduleactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0moduleactivityDnsAnswer:
      title: ocsfv1.3.0moduleactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0moduleactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0moduleactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityDomainContact:
      title: ocsfv1.3.0moduleactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0moduleactivityDomainContact_TypeId:
      title: ocsfv1.3.0moduleactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityEmail:
      title: ocsfv1.3.0moduleactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0moduleactivityEmailAuth:
      title: ocsfv1.3.0moduleactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0moduleactivityEnrichment:
      title: ocsfv1.3.0moduleactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0moduleactivityEpss:
      title: ocsfv1.3.0moduleactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0moduleactivityExtension:
      title: ocsfv1.3.0moduleactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0moduleactivityFeature:
      title: ocsfv1.3.0moduleactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0moduleactivityFile:
      title: ocsfv1.3.0moduleactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0moduleactivityFile_ConfidentialityId:
      title: ocsfv1.3.0moduleactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityFile_TypeId:
      title: ocsfv1.3.0moduleactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityFingerprint:
      title: ocsfv1.3.0moduleactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0moduleactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0moduleactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityFirewallRule:
      title: ocsfv1.3.0moduleactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0moduleactivityGroup:
      title: ocsfv1.3.0moduleactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0moduleactivityIdp:
      title: ocsfv1.3.0moduleactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0moduleactivityImage:
      title: ocsfv1.3.0moduleactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0moduleactivityKbArticle:
      title: ocsfv1.3.0moduleactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0moduleactivityKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0moduleactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0moduleactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityKeyboardInfo:
      title: ocsfv1.3.0moduleactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0moduleactivityKillChainPhase:
      title: ocsfv1.3.0moduleactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0moduleactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0moduleactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0moduleactivityLdapPerson:
      title: ocsfv1.3.0moduleactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0moduleactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0moduleactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0moduleactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityLocation:
      title: ocsfv1.3.0moduleactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0moduleactivityLogger:
      title: ocsfv1.3.0moduleactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0moduleactivityMalware:
      title: ocsfv1.3.0moduleactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0moduleactivityMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0moduleactivityMalware_ClassificationIds:
      title: ocsfv1.3.0moduleactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityMetadata:
      title: ocsfv1.3.0moduleactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0moduleactivityMetric:
      title: ocsfv1.3.0moduleactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0moduleactivityModule:
      title: ocsfv1.3.0moduleactivityModule
      type: object
      description: The Module object describes the load attributes of a module.
      properties:
        base_address:
          type: string
          nullable: true
          description: The memory address where the module was loaded.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFile'
          nullable: true
          description: The module file object.
        function_name:
          type: string
          nullable: true
          description: >-
            The entry-point function of the module. The system calls the
            entry-point function whenever a process or thread loads or unloads
            the module.
        load_type:
          type: string
          nullable: true
          description: >-
            The load type, normalized to the caption of the load_type_id value.
            In the case of 'Other', it is defined by the event source.
        load_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityModule_LoadTypeId'
          description: The normalized identifier for how the module was loaded in memory.
        start_address:
          type: string
          nullable: true
          description: The start address of the execution.
        type:
          type: string
          nullable: true
          description: The module type.
      required:
        - load_type_id
    ocsfv1.3.0moduleactivityModule_LoadTypeId:
      title: ocsfv1.3.0moduleactivityModule_LoadTypeId
      type: integer
      description: >-
        ModuleLoadTypeId is an enum, and the following values are allowed.

        0 - Unknown: The load type is unknown.

        1 - Standard: A normal module loaded by the normal windows loading
        mechanism i.e. LoadLibrary.

        2 - NonStandard: A module loaded in a way avoidant of normal windows
        procedures. i.e. Bootstrapped Loading/Manual Dll Loading.

        3 - ShellCode: A raw module in process memory that is READWRITE_EXECUTE
        and had a thread started in its range.

        4 - Mapped: A memory mapped file, typically created with
        CreatefileMapping/MapViewOfFile.

        5 - NonStandardBacked: A module loaded in a non standard way. However,
        GetModuleFileName succeeds on this allocation.

        99 - Other: The load type is not mapped. See the <code>load_type</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0moduleactivityNetworkInterface:
      title: ocsfv1.3.0moduleactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0moduleactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0moduleactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityObject:
      title: ocsfv1.3.0moduleactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0moduleactivityObservable:
      title: ocsfv1.3.0moduleactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0moduleactivityObservable_TypeId:
      title: ocsfv1.3.0moduleactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0moduleactivityOrganization:
      title: ocsfv1.3.0moduleactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0moduleactivityOs:
      title: ocsfv1.3.0moduleactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0moduleactivityOs_TypeId:
      title: ocsfv1.3.0moduleactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0moduleactivityOsint:
      title: ocsfv1.3.0moduleactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0moduleactivityOsint_ConfidenceId:
      title: ocsfv1.3.0moduleactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityOsint_Tlp:
      title: ocsfv1.3.0moduleactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0moduleactivityOsint_TypeId:
      title: ocsfv1.3.0moduleactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0moduleactivityPackage:
      title: ocsfv1.3.0moduleactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0moduleactivityPackage_TypeId:
      title: ocsfv1.3.0moduleactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityPolicy:
      title: ocsfv1.3.0moduleactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0moduleactivityProcess:
      title: ocsfv1.3.0moduleactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0moduleactivityProcess_IntegrityId:
      title: ocsfv1.3.0moduleactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0moduleactivityProduct:
      title: ocsfv1.3.0moduleactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0moduleactivityRemediation:
      title: ocsfv1.3.0moduleactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0moduleactivityReputation:
      title: ocsfv1.3.0moduleactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0moduleactivityReputation_ScoreId:
      title: ocsfv1.3.0moduleactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0moduleactivityRequest:
      title: ocsfv1.3.0moduleactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0moduleactivityResponse:
      title: ocsfv1.3.0moduleactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0moduleactivityService:
      title: ocsfv1.3.0moduleactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0moduleactivitySession:
      title: ocsfv1.3.0moduleactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0moduleactivitySubTechnique:
      title: ocsfv1.3.0moduleactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0moduleactivityTactic:
      title: ocsfv1.3.0moduleactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0moduleactivityTechnique:
      title: ocsfv1.3.0moduleactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0moduleactivityTimespan:
      title: ocsfv1.3.0moduleactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0moduleactivityTimespan_TypeId:
      title: ocsfv1.3.0moduleactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityUrl:
      title: ocsfv1.3.0moduleactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0moduleactivityUrl_CategoryIds:
      title: ocsfv1.3.0moduleactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0moduleactivityUser:
      title: ocsfv1.3.0moduleactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0moduleactivityUser_MfaStatusId:
      title: ocsfv1.3.0moduleactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityUser_RiskLevelId:
      title: ocsfv1.3.0moduleactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0moduleactivityUser_TypeId:
      title: ocsfv1.3.0moduleactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0moduleactivityUser_UserStatusId:
      title: ocsfv1.3.0moduleactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0moduleactivityVulnerability:
      title: ocsfv1.3.0moduleactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0moduleactivityWhois:
      title: ocsfv1.3.0moduleactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0moduleactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0moduleactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0moduleactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0moduleactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityEmailAddress:
      title: ocsfv1.3.0networkactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0networkactivityFileName:
      title: ocsfv1.3.0networkactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0networkactivityHash:
      title: ocsfv1.3.0networkactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0networkactivityHostname:
      title: ocsfv1.3.0networkactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0networkactivityIPAddress:
      title: ocsfv1.3.0networkactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0networkactivityMACAddress:
      title: ocsfv1.3.0networkactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0networkactivityPort:
      title: ocsfv1.3.0networkactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0networkactivityProcessName:
      title: ocsfv1.3.0networkactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0networkactivitySubnet:
      title: ocsfv1.3.0networkactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0networkactivityTimestamp:
      title: ocsfv1.3.0networkactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0networkactivityURLString:
      title: ocsfv1.3.0networkactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0networkactivityUserName:
      title: ocsfv1.3.0networkactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0networkactivityActionId:
      title: ocsfv1.3.0networkactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityActivityId:
      title: ocsfv1.3.0networkactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Open: A new network connection was opened.

        2 - Close: The network connection was closed.

        3 - Reset: The network connection was abnormally terminated or closed by
        a middle device like firewalls.

        4 - Fail: The network connection failed. For example a connection
        timeout or no route to host.

        5 - Refuse: The network connection was refused. For example an attempt
        to connect to a server port which is not open.

        6 - Traffic: Network traffic report.

        7 - Listen: A network endpoint began listening for new network
        connections.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityCategoryUid:
      title: ocsfv1.3.0networkactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        4 - NetworkActivity: Network Activity events.
    ocsfv1.3.0networkactivityClassUid:
      title: ocsfv1.3.0networkactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        4001 - NetworkActivity: Network Activity events report network
        connection and traffic activity.
    ocsfv1.3.0networkactivityDispositionId:
      title: ocsfv1.3.0networkactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityNetworkActivity:
      title: ocsfv1.3.0networkactivityNetworkActivity
      type: object
      description: Network Activity events report network connection and traffic activity.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        app_name:
          type: string
          nullable: true
          description: The name of the application associated with the event or object.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Network Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        connection_info:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkConnectionInfo'
          nullable: true
          description: The network connection information.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkEndpoint'
          description: The responder (server) in a network connection.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        ja4_fingerprint_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityJa4Fingerprint'
          nullable: true
          description: A list of the JA4+ network fingerprints.
        load_balancer:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLoadBalancer'
          nullable: true
          description: >-
            The Load Balancer object contains information related to the device
            that is distributing incoming traffic to specified destinations.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        proxy:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_connection_info:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkConnectionInfo'
          nullable: true
          description: >-
            The connection information from the proxy server to the remote
            server.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_http_request:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHttpRequest'
          nullable: true
          description: The HTTP Request from the proxy server to the remote server.
        proxy_http_response:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHttpResponse'
          nullable: true
          description: The HTTP Response from the remote server to the proxy server.
        proxy_tls:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTls'
          nullable: true
          description: >-
            The TLS protocol negotiated between the proxy server and the remote
            server.
        proxy_traffic:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkTraffic'
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network, from proxy to remote server at a given point of time.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkEndpoint'
          nullable: true
          description: The initiator (client) of the network connection.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        tls:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTls'
          nullable: true
          description: The Transport Layer Security (TLS) attributes.
        traffic:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkTraffic'
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network at a given point of time. Intended to be used alongside
            Network Connection.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUrl'
          nullable: true
          description: The URL details relevant to the network traffic.
      required:
        - activity_id
        - category_uid
        - class_uid
        - dst_endpoint
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0networkactivitySeverityId:
      title: ocsfv1.3.0networkactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0networkactivityStatusId:
      title: ocsfv1.3.0networkactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityTypeUid:
      title: ocsfv1.3.0networkactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        400100 - Unknown

        400101 - Open: A new network connection was opened.

        400102 - Close: The network connection was closed.

        400103 - Reset: The network connection was abnormally terminated or
        closed by a middle device like firewalls.

        400104 - Fail: The network connection failed. For example a connection
        timeout or no route to host.

        400105 - Refuse: The network connection was refused. For example an
        attempt to connect to a server port which is not open.

        400106 - Traffic: Network traffic report.

        400107 - Listen: A network endpoint began listening for new network
        connections.

        400199 - Other
    ocsfv1.3.0networkactivityAccount:
      title: ocsfv1.3.0networkactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0networkactivityAccount_TypeId:
      title: ocsfv1.3.0networkactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0networkactivityActor:
      title: ocsfv1.3.0networkactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0networkactivityActor_ActorTypeId:
      title: ocsfv1.3.0networkactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityAffectedCode:
      title: ocsfv1.3.0networkactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0networkactivityAffectedPackage:
      title: ocsfv1.3.0networkactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0networkactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0networkactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityAgent:
      title: ocsfv1.3.0networkactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0networkactivityAgent_TypeId:
      title: ocsfv1.3.0networkactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityApi:
      title: ocsfv1.3.0networkactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0networkactivityAttack:
      title: ocsfv1.3.0networkactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0networkactivityAuthorization:
      title: ocsfv1.3.0networkactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0networkactivityAutonomousSystem:
      title: ocsfv1.3.0networkactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0networkactivityCertificate:
      title: ocsfv1.3.0networkactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0networkactivityCloud:
      title: ocsfv1.3.0networkactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0networkactivityContainer:
      title: ocsfv1.3.0networkactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0networkactivityCve:
      title: ocsfv1.3.0networkactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0networkactivityCvss:
      title: ocsfv1.3.0networkactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0networkactivityCvss_Depth:
      title: ocsfv1.3.0networkactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0networkactivityCwe:
      title: ocsfv1.3.0networkactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0networkactivityDevice:
      title: ocsfv1.3.0networkactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0networkactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0networkactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0networkactivityDevice_RiskLevelId:
      title: ocsfv1.3.0networkactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0networkactivityDevice_TypeId:
      title: ocsfv1.3.0networkactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0networkactivityDeviceHwInfo:
      title: ocsfv1.3.0networkactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0networkactivityDigitalSignature:
      title: ocsfv1.3.0networkactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0networkactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0networkactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityDigitalSignature_StateId:
      title: ocsfv1.3.0networkactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityDisplay:
      title: ocsfv1.3.0networkactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0networkactivityDnsAnswer:
      title: ocsfv1.3.0networkactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0networkactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0networkactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityDomainContact:
      title: ocsfv1.3.0networkactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0networkactivityDomainContact_TypeId:
      title: ocsfv1.3.0networkactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityEmail:
      title: ocsfv1.3.0networkactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0networkactivityEmailAuth:
      title: ocsfv1.3.0networkactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0networkactivityEndpointConnection:
      title: ocsfv1.3.0networkactivityEndpointConnection
      type: object
      description: >-
        The Endpoint Connection object contains information detailing a
        connection attempt to an endpoint.
      properties:
        code:
          type: integer
          nullable: true
          description: >-
            A numerical response status code providing details about the
            connection.
        network_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkEndpoint'
          nullable: true
          description: Provides characteristics of the network endpoint.
    ocsfv1.3.0networkactivityEnrichment:
      title: ocsfv1.3.0networkactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0networkactivityEpss:
      title: ocsfv1.3.0networkactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0networkactivityExtension:
      title: ocsfv1.3.0networkactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0networkactivityFeature:
      title: ocsfv1.3.0networkactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0networkactivityFile:
      title: ocsfv1.3.0networkactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0networkactivityFile_ConfidentialityId:
      title: ocsfv1.3.0networkactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityFile_TypeId:
      title: ocsfv1.3.0networkactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityFingerprint:
      title: ocsfv1.3.0networkactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0networkactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0networkactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityFirewallRule:
      title: ocsfv1.3.0networkactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0networkactivityGroup:
      title: ocsfv1.3.0networkactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0networkactivityHttpHeader:
      title: ocsfv1.3.0networkactivityHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0networkactivityHttpRequest:
      title: ocsfv1.3.0networkactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0networkactivityHttpRequest_HttpMethod:
      title: ocsfv1.3.0networkactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0networkactivityHttpResponse:
      title: ocsfv1.3.0networkactivityHttpResponse
      type: object
      description: >-
        The HTTP Response object contains detailed information about the
        response sent from a web server to the requester. It encompasses
        attributes and metadata that describe the response status, headers, body
        content, and other relevant information.
      properties:
        code:
          type: integer
          description: >-
            The Hypertext Transfer Protocol (HTTP) status code returned from the
            web server to the client. For example, 200.
        content_type:
          type: string
          nullable: true
          description: >-
            The request header that identifies the original <a target="_blank"
            href="https://www.iana.org/assignments/media-types/media-types.xhtml">media
            type </a> of the resource (prior to any content encoding applied for
            sending).
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        latency:
          type: integer
          nullable: true
          description: The HTTP response latency measured in milliseconds.
        length:
          type: integer
          nullable: true
          description: The HTTP response length, in number of bytes.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        status:
          type: string
          nullable: true
          description: >-
            The response status. For example: A successful HTTP status of 'OK'
            which corresponds to a code of 200.
      required:
        - code
    ocsfv1.3.0networkactivityIdp:
      title: ocsfv1.3.0networkactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0networkactivityImage:
      title: ocsfv1.3.0networkactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0networkactivityJa4Fingerprint:
      title: ocsfv1.3.0networkactivityJa4Fingerprint
      type: object
      description: >-
        The JA4+ fingerprint object provides detailed fingerprint information
        about various aspects of network traffic which is both machine and human
        readable.
      properties:
        section_a:
          type: string
          nullable: true
          description: The 'a' section of the JA4 fingerprint.
        section_b:
          type: string
          nullable: true
          description: The 'b' section of the JA4 fingerprint.
        section_c:
          type: string
          nullable: true
          description: The 'c' section of the JA4 fingerprint.
        section_d:
          type: string
          nullable: true
          description: The 'd' section of the JA4 fingerprint.
        type:
          type: string
          nullable: true
          description: >-
            The JA4+ fingerprint type as defined by <a
            href="https://blog.foxio.io/ja4+-network-fingerprinting
            target=">FoxIO</a>, normalized to the caption of 'type_id'. In the
            case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityJa4Fingerprint_TypeId'
          description: The identifier of the JA4+ fingerprint type.
        value:
          type: string
          description: The JA4+ fingerprint value.
      required:
        - type_id
        - value
    ocsfv1.3.0networkactivityJa4Fingerprint_TypeId:
      title: ocsfv1.3.0networkactivityJa4Fingerprint_TypeId
      type: integer
      description: >-
        Ja4FingerprintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - JA4: TLS Client Fingerprint.

        2 - JA4Server: TLS Server Response/Session Fingerprint.

        3 - JA4HTTP: HTTP Client Fingerprint.

        4 - JA4Latency: Latency Measurement/Light Distance Fingerprint.

        5 - JA4X509: X509 TLS Certificate Fingerprint.

        6 - JA4SSH: SSH Traffic Fingerprint.

        7 - JA4TCP: Passive TCP Client Fingerprint.

        8 - JA4TCPServer: Passive TCP Server Fingerprint.

        9 - JA4TCPScan: Active TCP Server Fingerprint.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityKbArticle:
      title: ocsfv1.3.0networkactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0networkactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0networkactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityKeyboardInfo:
      title: ocsfv1.3.0networkactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0networkactivityKillChainPhase:
      title: ocsfv1.3.0networkactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0networkactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0networkactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0networkactivityLdapPerson:
      title: ocsfv1.3.0networkactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0networkactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0networkactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityLoadBalancer:
      title: ocsfv1.3.0networkactivityLoadBalancer
      type: object
      description: >-
        The load balancer object describes the load balancer entity and contains
        additional information regarding the distribution of traffic across a
        network.
      properties:
        classification:
          type: string
          nullable: true
          description: The request classification as defined by the load balancer.
        code:
          type: integer
          nullable: true
          description: >-
            The numeric response status code detailing the connection from the
            load balancer to the destination target.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkEndpoint'
          nullable: true
          description: The destination to which the load balancer is distributing traffic.
        endpoint_connections:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityEndpointConnection'
          nullable: true
          description: >-
            An object detailing the load balancer connection attempts and
            responses.
        error_message:
          type: string
          nullable: true
          description: The load balancer error message.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: >-
            The IP address of the load balancer node that handled the client
            request. Note: the load balancer may have other IP addresses, and
            this is not an IP address of the target/distribution endpoint - see
            <code>dst_endpoint</code>.
        message:
          type: string
          nullable: true
          description: The load balancer message.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityMetric'
          nullable: true
          description: General purpose metrics associated with the load balancer.
        name:
          type: string
          nullable: true
          description: The name of the load balancer.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional status information about the
            load balancer distribution event.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the load balancer.
    ocsfv1.3.0networkactivityLocation:
      title: ocsfv1.3.0networkactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0networkactivityLogger:
      title: ocsfv1.3.0networkactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0networkactivityMalware:
      title: ocsfv1.3.0networkactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0networkactivityMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0networkactivityMalware_ClassificationIds:
      title: ocsfv1.3.0networkactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityMetadata:
      title: ocsfv1.3.0networkactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0networkactivityMetric:
      title: ocsfv1.3.0networkactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0networkactivityNetworkConnectionInfo:
      title: ocsfv1.3.0networkactivityNetworkConnectionInfo
      type: object
      description: >-
        The Network Connection Information object describes characteristics of a
        network connection. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/">d3f:NetworkSession</a>.
      properties:
        boundary:
          type: string
          nullable: true
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'. In the case of 'Other', it is defined by the event
            source. <p> For cloud connections, this translates to the
            traffic-boundary(same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        boundary_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityNetworkConnectionInfo_BoundaryId
          nullable: true
          description: >-
            <p>The normalized identifier of the boundary of the connection.
            </p><p> For cloud connections, this translates to the
            traffic-boundary (same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the initiated connection, traffic, or email,
            normalized to the caption of the direction_id value. In the case of
            'Other', it is defined by the event source.
        direction_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityNetworkConnectionInfo_DirectionId
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The TCP/IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>tcp</code> or <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The TCP/IP protocol number, as defined by the Internet Assigned
            Numbers Authority (IANA). Use -1 if the protocol is not defined by
            IANA. See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>6</code> for TCP and <code>17</code>
            for UDP.
        protocol_ver:
          type: string
          nullable: true
          description: The Internet Protocol version.
        protocol_ver_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityNetworkConnectionInfo_ProtocolVerId
          nullable: true
          description: The Internet Protocol version identifier.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySession'
          nullable: true
          description: The authenticated user or service session.
        tcp_flags:
          type: integer
          nullable: true
          description: The network connection TCP header flags (i.e., control bits).
        uid:
          type: string
          nullable: true
          description: The unique identifier of the connection.
      required:
        - direction_id
    ocsfv1.3.0networkactivityNetworkConnectionInfo_BoundaryId:
      title: ocsfv1.3.0networkactivityNetworkConnectionInfo_BoundaryId
      type: integer
      description: >-
        NetworkConnectionInfoBoundaryId is an enum, and the following values are
        allowed.

        0 - Unknown: The connection boundary is unknown.

        1 - Localhost: Local network traffic on the same endpoint.

        2 - Internal: Internal network traffic between two endpoints inside
        network.

        3 - External: External network traffic between two endpoints on the
        Internet or outside the network.

        4 - SameVPC: Through another resource in the same VPC

        5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint

        6 - VirtualPrivateGateway: Through a virtual private gateway

        7 - regionVPC: Through an intra-region VPC peering connection

        8 - regionVPC: Through an inter-region VPC peering connection

        9 - LocalGateway: Through a local gateway

        10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances
        only)

        11 - InternetGateway: Through an Internet gateway (Nitro-based instances
        only)

        99 - Other: The boundary is not mapped. See the <code>boundary</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityNetworkConnectionInfo_DirectionId:
      title: ocsfv1.3.0networkactivityNetworkConnectionInfo_DirectionId
      type: integer
      description: >-
        NetworkConnectionInfoDirectionId is an enum, and the following values
        are allowed.

        0 - Unknown: The connection direction is unknown.

        1 - Inbound: Inbound network connection. The connection was originated
        from the Internet or outside network, destined for services on the
        inside network.

        2 - Outbound: Outbound network connection. The connection was originated
        from inside the network, destined for services on the Internet or
        outside network.

        3 - Lateral: Lateral network connection. The connection was originated
        from inside the network, destined for services on the inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0networkactivityNetworkConnectionInfo_ProtocolVerId:
      title: ocsfv1.3.0networkactivityNetworkConnectionInfo_ProtocolVerId
      type: integer
      description: >-
        NetworkConnectionInfoProtocolVerId is an enum, and the following values
        are allowed.

        0 - Unknown: The protocol version is unknown.

        4 - IPv4*

        6 - IPv6*

        99 - Other: The protocol version is not mapped. See the
        <code>protocol_ver</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityNetworkEndpoint:
      title: ocsfv1.3.0networkactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0networkactivityNetworkEndpoint_TypeId:
      title: ocsfv1.3.0networkactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0networkactivityNetworkInterface:
      title: ocsfv1.3.0networkactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0networkactivityNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0networkactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0networkactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityNetworkProxy:
      title: ocsfv1.3.0networkactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0networkactivityNetworkProxy_TypeId:
      title: ocsfv1.3.0networkactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0networkactivityNetworkTraffic:
      title: ocsfv1.3.0networkactivityNetworkTraffic
      type: object
      description: >-
        The Network Traffic object describes characteristics of network traffic.
        Network traffic refers to data moving across a network at a given point
        of time. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkTraffic/">d3f:NetworkTraffic</a>.
      properties:
        bytes:
          type: integer
          nullable: true
          description: The total number of bytes (in and out).
        bytes_in:
          type: integer
          nullable: true
          description: The number of bytes sent from the destination to the source.
        bytes_out:
          type: integer
          nullable: true
          description: The number of bytes sent from the source to the destination.
        chunks:
          type: integer
          nullable: true
          description: The total number of chunks (in and out).
        chunks_in:
          type: integer
          nullable: true
          description: The number of chunks sent from the destination to the source.
        chunks_out:
          type: integer
          nullable: true
          description: The number of chunks sent from the source to the destination.
        packets:
          type: integer
          nullable: true
          description: The total number of packets (in and out).
        packets_in:
          type: integer
          nullable: true
          description: The number of packets sent from the destination to the source.
        packets_out:
          type: integer
          nullable: true
          description: The number of packets sent from the source to the destination.
    ocsfv1.3.0networkactivityObject:
      title: ocsfv1.3.0networkactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0networkactivityObservable:
      title: ocsfv1.3.0networkactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0networkactivityObservable_TypeId:
      title: ocsfv1.3.0networkactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0networkactivityOrganization:
      title: ocsfv1.3.0networkactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0networkactivityOs:
      title: ocsfv1.3.0networkactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0networkactivityOs_TypeId:
      title: ocsfv1.3.0networkactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0networkactivityOsint:
      title: ocsfv1.3.0networkactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0networkactivityOsint_ConfidenceId:
      title: ocsfv1.3.0networkactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityOsint_Tlp:
      title: ocsfv1.3.0networkactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0networkactivityOsint_TypeId:
      title: ocsfv1.3.0networkactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0networkactivityPackage:
      title: ocsfv1.3.0networkactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0networkactivityPackage_TypeId:
      title: ocsfv1.3.0networkactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityPolicy:
      title: ocsfv1.3.0networkactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0networkactivityProcess:
      title: ocsfv1.3.0networkactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0networkactivityProcess_IntegrityId:
      title: ocsfv1.3.0networkactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0networkactivityProduct:
      title: ocsfv1.3.0networkactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0networkactivityRemediation:
      title: ocsfv1.3.0networkactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0networkactivityReputation:
      title: ocsfv1.3.0networkactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0networkactivityReputation_ScoreId:
      title: ocsfv1.3.0networkactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0networkactivityRequest:
      title: ocsfv1.3.0networkactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0networkactivityResponse:
      title: ocsfv1.3.0networkactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0networkactivitySan:
      title: ocsfv1.3.0networkactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.3.0networkactivityService:
      title: ocsfv1.3.0networkactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0networkactivitySession:
      title: ocsfv1.3.0networkactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0networkactivitySubTechnique:
      title: ocsfv1.3.0networkactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0networkactivityTactic:
      title: ocsfv1.3.0networkactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0networkactivityTechnique:
      title: ocsfv1.3.0networkactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0networkactivityTimespan:
      title: ocsfv1.3.0networkactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0networkactivityTimespan_TypeId:
      title: ocsfv1.3.0networkactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityTls:
      title: ocsfv1.3.0networkactivityTls
      type: object
      description: >-
        The Transport Layer Security (TLS) object describes the negotiated TLS
        protocol used for secure communications over an establish network
        connection.
      properties:
        alert:
          type: integer
          nullable: true
          description: >-
            The integer value of TLS alert if present. The alerts are defined in
            the TLS specification in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc2246">RFC-2246</a>.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        certificate_chain:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Chain of Certificate Serial Numbers field provides a chain of
            Certificate Issuer Serial Numbers leading to the Root Certificate
            Issuer.
        cipher:
          type: string
          nullable: true
          description: The negotiated cipher suite.
        client_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The client cipher suites that were exchanged during the TLS
            handshake negotiation.
        extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        handshake_dur:
          type: integer
          nullable: true
          description: >-
            The amount of total time for the TLS handshake to complete after the
            TCP connection is established, including client-side delays, in
            milliseconds.
        ja3_hash:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3 string.
        ja3s_hash:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3S string.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        server_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The server cipher suites that were exchanged during the TLS
            handshake negotiation.
        sni:
          type: string
          nullable: true
          description: The Server Name Indication (SNI) extension sent by the client.
        tls_extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        version:
          type: string
          description: The TLS protocol version.
      required:
        - version
    ocsfv1.3.0networkactivityTlsExtension:
      title: ocsfv1.3.0networkactivityTlsExtension
      type: object
      description: >-
        The TLS Extension object describes additional attributes that extend the
        base Transport Layer Security (TLS) object.
      properties:
        data:
          nullable: true
          description: >-
            The data contains information specific to the particular extension
            type.
        type:
          type: string
          nullable: true
          description: 'The TLS extension type. For example: <code>Server Name</code>.'
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTlsExtension_TypeId'
          description: >-
            The TLS extension type identifier. See <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc8446#page-35'>The
            Transport Layer Security (TLS) extension page</a>.
      required:
        - type_id
    ocsfv1.3.0networkactivityTlsExtension_TypeId:
      title: ocsfv1.3.0networkactivityTlsExtension_TypeId
      type: integer
      description: >-
        TlsExtensionTypeId is an enum, and the following values are allowed.

        0 - name: The Server Name Indication extension.

        1 - fragment_length: The Maximum Fragment Length Negotiation extension.

        5 - request: The Certificate Status Request extension.

        10 - groups: The Supported Groups extension.

        13 - algorithms: The Signature Algorithms extension.

        14 - srtp: The Use SRTP data protection extension.

        15 - heartbeat: The Heartbeat extension.

        16 - layer_protocol_negotiation: The Application-Layer Protocol
        Negotiation extension.

        18 - certificate_timestamp: The Signed Certificate Timestamp extension.

        19 - certificate_type: The Client Certificate Type extension.

        20 - certificate_type: The Server Certificate Type extension.

        21 - padding: The Padding extension.

        41 - shared_key: The Pre Shared Key extension.

        42 - data: The Early Data extension.

        43 - versions: The Supported Versions extension.

        44 - cookie: The Cookie extension.

        45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension.

        47 - authorities: The Certificate Authorities extension.

        48 - filters: The OID Filters extension.

        49 - handshake_auth: The Post-Handshake Client Authentication extension.

        50 - algorithms_cert: The Signature Algorithms extension.

        51 - share: The Key Share extension.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityUrl:
      title: ocsfv1.3.0networkactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0networkactivityUrl_CategoryIds:
      title: ocsfv1.3.0networkactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0networkactivityUser:
      title: ocsfv1.3.0networkactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0networkactivityUser_MfaStatusId:
      title: ocsfv1.3.0networkactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityUser_RiskLevelId:
      title: ocsfv1.3.0networkactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0networkactivityUser_TypeId:
      title: ocsfv1.3.0networkactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0networkactivityUser_UserStatusId:
      title: ocsfv1.3.0networkactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0networkactivityVulnerability:
      title: ocsfv1.3.0networkactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0networkactivityWhois:
      title: ocsfv1.3.0networkactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0networkactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0networkactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0networkactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0networkactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityEmailAddress:
      title: ocsfv1.3.0processactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0processactivityFileName:
      title: ocsfv1.3.0processactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0processactivityHash:
      title: ocsfv1.3.0processactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0processactivityHostname:
      title: ocsfv1.3.0processactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0processactivityIPAddress:
      title: ocsfv1.3.0processactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0processactivityMACAddress:
      title: ocsfv1.3.0processactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0processactivityPort:
      title: ocsfv1.3.0processactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0processactivityProcessName:
      title: ocsfv1.3.0processactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0processactivitySubnet:
      title: ocsfv1.3.0processactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0processactivityTimestamp:
      title: ocsfv1.3.0processactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0processactivityURLString:
      title: ocsfv1.3.0processactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0processactivityUserName:
      title: ocsfv1.3.0processactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0processactivityActionId:
      title: ocsfv1.3.0processactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityActivityId:
      title: ocsfv1.3.0processactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Launch

        2 - Terminate

        3 - Open

        4 - Inject

        5 - SetUserID

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityCategoryUid:
      title: ocsfv1.3.0processactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        1 - SystemActivity: System Activity events.
    ocsfv1.3.0processactivityClassUid:
      title: ocsfv1.3.0processactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        1007 - ProcessActivity: Process Activity events report when a process
        launches, injects, opens or terminates another process, successful or
        otherwise.
    ocsfv1.3.0processactivityDispositionId:
      title: ocsfv1.3.0processactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityInjectionTypeId:
      title: ocsfv1.3.0processactivityInjectionTypeId
      type: integer
      description: >-
        InjectionTypeId is an enum, and the following values are allowed.

        0 - Unknown: The injection type is unknown.

        1 - RemoteThread

        2 - LoadLibrary

        3 - QueueAPC

        99 - Other: The injection type is not mapped. See the
        <code>injection_type</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityProcessActivity:
      title: ocsfv1.3.0processactivityProcessActivity
      type: object
      description: >-
        Process Activity events report when a process launches, injects, opens
        or terminates another process, successful or otherwise.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityActor'
          description: >-
            The actor that performed the activity on the target
            <code>process</code>. For example, the process that started a new
            process or injected code into another process.
        actual_permissions:
          type: integer
          nullable: true
          description: >-
            The permissions that were granted to the in a platform-native
            format.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>System Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDevice'
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        exit_code:
          type: integer
          nullable: true
          description: >-
            The exit code reported by a process when it terminates. The
            convention is that zero indicates success and any non-zero exit code
            indicates that some error occurred.
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        injection_type:
          type: string
          nullable: true
          description: >-
            The process injection method, normalized to the caption of the
            injection_type_id value. In the case of 'Other', it is defined by
            the event source.
        injection_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityInjectionTypeId'
          nullable: true
          description: The normalized identifier of the process injection method.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityMetadata'
          description: The metadata associated with the event or a finding.
        module:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityModule'
          nullable: true
          description: The module that was injected by the actor process.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProcess'
          description: The process that was launched, injected into, opened, or terminated.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        requested_permissions:
          type: integer
          nullable: true
          description: The permissions mask that were requested by the process.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - actor
        - category_uid
        - class_uid
        - device
        - metadata
        - process
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0processactivitySeverityId:
      title: ocsfv1.3.0processactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0processactivityStatusId:
      title: ocsfv1.3.0processactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityTypeUid:
      title: ocsfv1.3.0processactivityTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        100700 - Unknown
        100701 - Launch
        100702 - Terminate
        100703 - Open
        100704 - Inject
        100705 - SetUserID
        100799 - Other
    ocsfv1.3.0processactivityAccount:
      title: ocsfv1.3.0processactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0processactivityAccount_TypeId:
      title: ocsfv1.3.0processactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0processactivityActor:
      title: ocsfv1.3.0processactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0processactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0processactivityActor_ActorTypeId:
      title: ocsfv1.3.0processactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityAffectedCode:
      title: ocsfv1.3.0processactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0processactivityAffectedPackage:
      title: ocsfv1.3.0processactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0processactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0processactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityAgent:
      title: ocsfv1.3.0processactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0processactivityAgent_TypeId:
      title: ocsfv1.3.0processactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityApi:
      title: ocsfv1.3.0processactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0processactivityAttack:
      title: ocsfv1.3.0processactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0processactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0processactivityAuthorization:
      title: ocsfv1.3.0processactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0processactivityAutonomousSystem:
      title: ocsfv1.3.0processactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0processactivityCertificate:
      title: ocsfv1.3.0processactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0processactivityCloud:
      title: ocsfv1.3.0processactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0processactivityContainer:
      title: ocsfv1.3.0processactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0processactivityCve:
      title: ocsfv1.3.0processactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0processactivityCvss:
      title: ocsfv1.3.0processactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0processactivityCvss_Depth:
      title: ocsfv1.3.0processactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0processactivityCwe:
      title: ocsfv1.3.0processactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0processactivityDevice:
      title: ocsfv1.3.0processactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0processactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0processactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0processactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0processactivityDevice_RiskLevelId:
      title: ocsfv1.3.0processactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0processactivityDevice_TypeId:
      title: ocsfv1.3.0processactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0processactivityDeviceHwInfo:
      title: ocsfv1.3.0processactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0processactivityDigitalSignature:
      title: ocsfv1.3.0processactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0processactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0processactivityDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0processactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0processactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityDigitalSignature_StateId:
      title: ocsfv1.3.0processactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityDisplay:
      title: ocsfv1.3.0processactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0processactivityDnsAnswer:
      title: ocsfv1.3.0processactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0processactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0processactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityDomainContact:
      title: ocsfv1.3.0processactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0processactivityDomainContact_TypeId:
      title: ocsfv1.3.0processactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityEmail:
      title: ocsfv1.3.0processactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0processactivityEmailAuth:
      title: ocsfv1.3.0processactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0processactivityEnrichment:
      title: ocsfv1.3.0processactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0processactivityEpss:
      title: ocsfv1.3.0processactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0processactivityExtension:
      title: ocsfv1.3.0processactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0processactivityFeature:
      title: ocsfv1.3.0processactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0processactivityFile:
      title: ocsfv1.3.0processactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0processactivityFile_ConfidentialityId:
      title: ocsfv1.3.0processactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityFile_TypeId:
      title: ocsfv1.3.0processactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityFingerprint:
      title: ocsfv1.3.0processactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0processactivityFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0processactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0processactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityFirewallRule:
      title: ocsfv1.3.0processactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0processactivityGroup:
      title: ocsfv1.3.0processactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0processactivityIdp:
      title: ocsfv1.3.0processactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0processactivityImage:
      title: ocsfv1.3.0processactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0processactivityKbArticle:
      title: ocsfv1.3.0processactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0processactivityKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0processactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0processactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityKeyboardInfo:
      title: ocsfv1.3.0processactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0processactivityKillChainPhase:
      title: ocsfv1.3.0processactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0processactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0processactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0processactivityLdapPerson:
      title: ocsfv1.3.0processactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0processactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0processactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0processactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityLocation:
      title: ocsfv1.3.0processactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0processactivityLogger:
      title: ocsfv1.3.0processactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0processactivityMalware:
      title: ocsfv1.3.0processactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0processactivityMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0processactivityMalware_ClassificationIds:
      title: ocsfv1.3.0processactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityMetadata:
      title: ocsfv1.3.0processactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0processactivityMetric:
      title: ocsfv1.3.0processactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0processactivityModule:
      title: ocsfv1.3.0processactivityModule
      type: object
      description: The Module object describes the load attributes of a module.
      properties:
        base_address:
          type: string
          nullable: true
          description: The memory address where the module was loaded.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFile'
          nullable: true
          description: The module file object.
        function_name:
          type: string
          nullable: true
          description: >-
            The entry-point function of the module. The system calls the
            entry-point function whenever a process or thread loads or unloads
            the module.
        load_type:
          type: string
          nullable: true
          description: >-
            The load type, normalized to the caption of the load_type_id value.
            In the case of 'Other', it is defined by the event source.
        load_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityModule_LoadTypeId'
          description: The normalized identifier for how the module was loaded in memory.
        start_address:
          type: string
          nullable: true
          description: The start address of the execution.
        type:
          type: string
          nullable: true
          description: The module type.
      required:
        - load_type_id
    ocsfv1.3.0processactivityModule_LoadTypeId:
      title: ocsfv1.3.0processactivityModule_LoadTypeId
      type: integer
      description: >-
        ModuleLoadTypeId is an enum, and the following values are allowed.

        0 - Unknown: The load type is unknown.

        1 - Standard: A normal module loaded by the normal windows loading
        mechanism i.e. LoadLibrary.

        2 - NonStandard: A module loaded in a way avoidant of normal windows
        procedures. i.e. Bootstrapped Loading/Manual Dll Loading.

        3 - ShellCode: A raw module in process memory that is READWRITE_EXECUTE
        and had a thread started in its range.

        4 - Mapped: A memory mapped file, typically created with
        CreatefileMapping/MapViewOfFile.

        5 - NonStandardBacked: A module loaded in a non standard way. However,
        GetModuleFileName succeeds on this allocation.

        99 - Other: The load type is not mapped. See the <code>load_type</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0processactivityNetworkInterface:
      title: ocsfv1.3.0processactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0processactivityNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0processactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0processactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityObject:
      title: ocsfv1.3.0processactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0processactivityObservable:
      title: ocsfv1.3.0processactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0processactivityObservable_TypeId:
      title: ocsfv1.3.0processactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0processactivityOrganization:
      title: ocsfv1.3.0processactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0processactivityOs:
      title: ocsfv1.3.0processactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0processactivityOs_TypeId:
      title: ocsfv1.3.0processactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0processactivityOsint:
      title: ocsfv1.3.0processactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0processactivityOsint_ConfidenceId:
      title: ocsfv1.3.0processactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityOsint_Tlp:
      title: ocsfv1.3.0processactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0processactivityOsint_TypeId:
      title: ocsfv1.3.0processactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0processactivityPackage:
      title: ocsfv1.3.0processactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0processactivityPackage_TypeId:
      title: ocsfv1.3.0processactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityPolicy:
      title: ocsfv1.3.0processactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0processactivityProcess:
      title: ocsfv1.3.0processactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0processactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0processactivityProcess_IntegrityId:
      title: ocsfv1.3.0processactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0processactivityProduct:
      title: ocsfv1.3.0processactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0processactivityRemediation:
      title: ocsfv1.3.0processactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0processactivityReputation:
      title: ocsfv1.3.0processactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0processactivityReputation_ScoreId:
      title: ocsfv1.3.0processactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0processactivityRequest:
      title: ocsfv1.3.0processactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0processactivityResponse:
      title: ocsfv1.3.0processactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0processactivityService:
      title: ocsfv1.3.0processactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0processactivitySession:
      title: ocsfv1.3.0processactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0processactivitySubTechnique:
      title: ocsfv1.3.0processactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0processactivityTactic:
      title: ocsfv1.3.0processactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0processactivityTechnique:
      title: ocsfv1.3.0processactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0processactivityTimespan:
      title: ocsfv1.3.0processactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0processactivityTimespan_TypeId:
      title: ocsfv1.3.0processactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityUrl:
      title: ocsfv1.3.0processactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0processactivityUrl_CategoryIds:
      title: ocsfv1.3.0processactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0processactivityUser:
      title: ocsfv1.3.0processactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0processactivityUser_MfaStatusId:
      title: ocsfv1.3.0processactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityUser_RiskLevelId:
      title: ocsfv1.3.0processactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0processactivityUser_TypeId:
      title: ocsfv1.3.0processactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0processactivityUser_UserStatusId:
      title: ocsfv1.3.0processactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0processactivityVulnerability:
      title: ocsfv1.3.0processactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0processactivityWhois:
      title: ocsfv1.3.0processactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0processactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0processactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0processactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0processactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0processactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityEmailAddress:
      title: ocsfv1.3.0scanactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0scanactivityFileName:
      title: ocsfv1.3.0scanactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0scanactivityHash:
      title: ocsfv1.3.0scanactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0scanactivityHostname:
      title: ocsfv1.3.0scanactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0scanactivityIPAddress:
      title: ocsfv1.3.0scanactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0scanactivityMACAddress:
      title: ocsfv1.3.0scanactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0scanactivityPort:
      title: ocsfv1.3.0scanactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0scanactivityProcessName:
      title: ocsfv1.3.0scanactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0scanactivitySubnet:
      title: ocsfv1.3.0scanactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0scanactivityTimestamp:
      title: ocsfv1.3.0scanactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0scanactivityURLString:
      title: ocsfv1.3.0scanactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0scanactivityUserName:
      title: ocsfv1.3.0scanactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0scanactivityActivityId:
      title: ocsfv1.3.0scanactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Started: The scan was started.

        2 - Completed: The scan was completed.

        3 - Cancelled: The scan was cancelled.

        4 - DurationViolation: The allocated scan time was insufficient to
        complete the requested scan.

        5 - PauseViolation: The scan was paused, either by the user or by
        program constraints (e.g. scans that are suspended during certain time
        intervals), and not resumed within the allotted time.

        6 - Error: The scan could not be completed due to an internal error.

        7 - Paused: The scan was paused.

        8 - Resumed: The scan was resumed from the pause point.

        9 - Restarted: The scan restarted from the beginning of the file
        enumeration.

        10 - Delayed: The user delayed the scan.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityCategoryUid:
      title: ocsfv1.3.0scanactivityCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        6 - ApplicationActivity: Application Activity events report detailed
        information about the behavior of applications and services.
    ocsfv1.3.0scanactivityClassUid:
      title: ocsfv1.3.0scanactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        6007 - ScanActivity: Scan events report the start, completion, and
        results of a scan job. The scan event includes the number of items that
        were scanned and the number of detections that were resolved.
    ocsfv1.3.0scanactivityScanActivity:
      title: ocsfv1.3.0scanactivityScanActivity
      type: object
      description: >-
        Scan events report the start, completion, and results of a scan job. The
        scan event includes the number of items that were scanned and the number
        of detections that were resolved.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityAgent'
          nullable: true
          description: The agents that were used to scan the devices.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Application Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        command_uid:
          type: string
          nullable: true
          description: >-
            The command identifier that is associated with this scan event. This
            ID uniquely identifies the proactive scan command, e.g., if remotely
            initiated.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: The duration of the scan
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The end time of the scan job.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The end time of the scan job.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityMetadata'
          description: The metadata associated with the event or a finding.
        num_detections:
          type: integer
          nullable: true
          description: The number of detections.
        num_files:
          type: integer
          nullable: true
          description: The number of files scanned.
        num_folders:
          type: integer
          nullable: true
          description: The number of folders scanned.
        num_hosts:
          type: integer
          nullable: true
          description: The number of hosts that were scanned.
        num_network_items:
          type: integer
          nullable: true
          description: The number of network items scanned.
        num_processes:
          type: integer
          nullable: true
          description: The number of processes scanned.
        num_registry_items:
          type: integer
          nullable: true
          description: The number of registry items scanned.
        num_resolutions:
          type: integer
          nullable: true
          description: The number of items that were resolved.
        num_skipped_items:
          type: integer
          nullable: true
          description: The number of skipped items.
        num_trusted_items:
          type: integer
          nullable: true
          description: The number of trusted items.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityPolicy'
          nullable: true
          description: >-
            The policy associated with this Scan event; required if the scan was
            initiated by a policy.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        scan:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityScan'
          description: The Scan object describes characteristics of the scan job.
        schedule_uid:
          type: string
          nullable: true
          description: The unique identifier of the schedule associated with a scan job.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The start time of the scan job.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The start time of the scan job.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        total:
          type: integer
          nullable: true
          description: >-
            The total number of items that were scanned; zero if no items were
            scanned.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - scan
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0scanactivitySeverityId:
      title: ocsfv1.3.0scanactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scanactivityStatusId:
      title: ocsfv1.3.0scanactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scanactivityTypeUid:
      title: ocsfv1.3.0scanactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        600700 - Unknown

        600701 - Started: The scan was started.

        600702 - Completed: The scan was completed.

        600703 - Cancelled: The scan was cancelled.

        600704 - DurationViolation: The allocated scan time was insufficient to
        complete the requested scan.

        600705 - PauseViolation: The scan was paused, either by the user or by
        program constraints (e.g. scans that are suspended during certain time
        intervals), and not resumed within the allotted time.

        600706 - Error: The scan could not be completed due to an internal
        error.

        600707 - Paused: The scan was paused.

        600708 - Resumed: The scan was resumed from the pause point.

        600709 - Restarted: The scan restarted from the beginning of the file
        enumeration.

        600710 - Delayed: The user delayed the scan.

        600799 - Other
    ocsfv1.3.0scanactivityAccount:
      title: ocsfv1.3.0scanactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0scanactivityAccount_TypeId:
      title: ocsfv1.3.0scanactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0scanactivityActor:
      title: ocsfv1.3.0scanactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0scanactivityActor_ActorTypeId:
      title: ocsfv1.3.0scanactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityAffectedCode:
      title: ocsfv1.3.0scanactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0scanactivityAffectedPackage:
      title: ocsfv1.3.0scanactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0scanactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0scanactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityAgent:
      title: ocsfv1.3.0scanactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0scanactivityAgent_TypeId:
      title: ocsfv1.3.0scanactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityApi:
      title: ocsfv1.3.0scanactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0scanactivityAttack:
      title: ocsfv1.3.0scanactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0scanactivityAuthorization:
      title: ocsfv1.3.0scanactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0scanactivityAutonomousSystem:
      title: ocsfv1.3.0scanactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0scanactivityCertificate:
      title: ocsfv1.3.0scanactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0scanactivityCloud:
      title: ocsfv1.3.0scanactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0scanactivityContainer:
      title: ocsfv1.3.0scanactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0scanactivityCve:
      title: ocsfv1.3.0scanactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0scanactivityCvss:
      title: ocsfv1.3.0scanactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0scanactivityCvss_Depth:
      title: ocsfv1.3.0scanactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0scanactivityCwe:
      title: ocsfv1.3.0scanactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0scanactivityDevice:
      title: ocsfv1.3.0scanactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0scanactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0scanactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0scanactivityDevice_RiskLevelId:
      title: ocsfv1.3.0scanactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scanactivityDevice_TypeId:
      title: ocsfv1.3.0scanactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0scanactivityDeviceHwInfo:
      title: ocsfv1.3.0scanactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0scanactivityDigitalSignature:
      title: ocsfv1.3.0scanactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scanactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0scanactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0scanactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scanactivityDigitalSignature_StateId:
      title: ocsfv1.3.0scanactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scanactivityDisplay:
      title: ocsfv1.3.0scanactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0scanactivityDnsAnswer:
      title: ocsfv1.3.0scanactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0scanactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0scanactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scanactivityDomainContact:
      title: ocsfv1.3.0scanactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0scanactivityDomainContact_TypeId:
      title: ocsfv1.3.0scanactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityEmail:
      title: ocsfv1.3.0scanactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0scanactivityEmailAuth:
      title: ocsfv1.3.0scanactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0scanactivityEnrichment:
      title: ocsfv1.3.0scanactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0scanactivityEpss:
      title: ocsfv1.3.0scanactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0scanactivityExtension:
      title: ocsfv1.3.0scanactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0scanactivityFeature:
      title: ocsfv1.3.0scanactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0scanactivityFile:
      title: ocsfv1.3.0scanactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0scanactivityFile_ConfidentialityId:
      title: ocsfv1.3.0scanactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityFile_TypeId:
      title: ocsfv1.3.0scanactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityFingerprint:
      title: ocsfv1.3.0scanactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0scanactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0scanactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scanactivityGroup:
      title: ocsfv1.3.0scanactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0scanactivityIdp:
      title: ocsfv1.3.0scanactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0scanactivityImage:
      title: ocsfv1.3.0scanactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0scanactivityKbArticle:
      title: ocsfv1.3.0scanactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0scanactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0scanactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityKeyboardInfo:
      title: ocsfv1.3.0scanactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0scanactivityKillChainPhase:
      title: ocsfv1.3.0scanactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0scanactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0scanactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scanactivityLdapPerson:
      title: ocsfv1.3.0scanactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scanactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0scanactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0scanactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityLocation:
      title: ocsfv1.3.0scanactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0scanactivityLogger:
      title: ocsfv1.3.0scanactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0scanactivityMetadata:
      title: ocsfv1.3.0scanactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0scanactivityMetric:
      title: ocsfv1.3.0scanactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0scanactivityNetworkInterface:
      title: ocsfv1.3.0scanactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0scanactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0scanactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityObject:
      title: ocsfv1.3.0scanactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0scanactivityObservable:
      title: ocsfv1.3.0scanactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0scanactivityObservable_TypeId:
      title: ocsfv1.3.0scanactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0scanactivityOrganization:
      title: ocsfv1.3.0scanactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0scanactivityOs:
      title: ocsfv1.3.0scanactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0scanactivityOs_TypeId:
      title: ocsfv1.3.0scanactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0scanactivityOsint:
      title: ocsfv1.3.0scanactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0scanactivityOsint_ConfidenceId:
      title: ocsfv1.3.0scanactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityOsint_Tlp:
      title: ocsfv1.3.0scanactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0scanactivityOsint_TypeId:
      title: ocsfv1.3.0scanactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0scanactivityPackage:
      title: ocsfv1.3.0scanactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0scanactivityPackage_TypeId:
      title: ocsfv1.3.0scanactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityPolicy:
      title: ocsfv1.3.0scanactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0scanactivityProcess:
      title: ocsfv1.3.0scanactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0scanactivityProcess_IntegrityId:
      title: ocsfv1.3.0scanactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scanactivityProduct:
      title: ocsfv1.3.0scanactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0scanactivityRemediation:
      title: ocsfv1.3.0scanactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0scanactivityReputation:
      title: ocsfv1.3.0scanactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0scanactivityReputation_ScoreId:
      title: ocsfv1.3.0scanactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scanactivityRequest:
      title: ocsfv1.3.0scanactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0scanactivityResponse:
      title: ocsfv1.3.0scanactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0scanactivityScan:
      title: ocsfv1.3.0scanactivityScan
      type: object
      description: The Scan object describes characteristics of a proactive scan.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The administrator-supplied or application-generated name of the
            scan. For example: "Home office weekly user database scan", "Scan
            folders for viruses", "Full system virus scan"
        targets:
          type: array
          items:
            type: string
          nullable: true
          description: Hosts or IP addresses targeted by the scan.
        type:
          type: string
          nullable: true
          description: The type of scan.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityScan_TypeId'
          description: The type id of the scan.
        uid:
          type: string
          nullable: true
          description: >-
            The application-defined unique identifier assigned to an instance of
            a scan.
      required:
        - type_id
    ocsfv1.3.0scanactivityScan_TypeId:
      title: ocsfv1.3.0scanactivityScan_TypeId
      type: integer
      description: >-
        ScanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Manual: The scan was manually initiated by the user or
        administrator.

        2 - Scheduled: The scan was started based on scheduler.

        3 - UpdatedContent: The scan was triggered by a content update.

        4 - QuarantinedItems: The scan was triggered by newly quarantined items.

        5 - AttachedMedia: The scan was triggered by the attachment of removable
        media.

        6 - UserLogon: The scan was started due to a user logon.

        7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM)
        detection.

        99 - Other: The scan type id is not mapped. See the <code>type</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scanactivityService:
      title: ocsfv1.3.0scanactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0scanactivitySession:
      title: ocsfv1.3.0scanactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0scanactivitySubTechnique:
      title: ocsfv1.3.0scanactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0scanactivityTactic:
      title: ocsfv1.3.0scanactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0scanactivityTechnique:
      title: ocsfv1.3.0scanactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0scanactivityTimespan:
      title: ocsfv1.3.0scanactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0scanactivityTimespan_TypeId:
      title: ocsfv1.3.0scanactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityUrl:
      title: ocsfv1.3.0scanactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0scanactivityUrl_CategoryIds:
      title: ocsfv1.3.0scanactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0scanactivityUser:
      title: ocsfv1.3.0scanactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0scanactivityUser_MfaStatusId:
      title: ocsfv1.3.0scanactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityUser_RiskLevelId:
      title: ocsfv1.3.0scanactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scanactivityUser_TypeId:
      title: ocsfv1.3.0scanactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scanactivityUser_UserStatusId:
      title: ocsfv1.3.0scanactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scanactivityVulnerability:
      title: ocsfv1.3.0scanactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0scanactivityWhois:
      title: ocsfv1.3.0scanactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scanactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0scanactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0scanactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityEmailAddress:
      title: ocsfv1.3.0scheduledjobactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0scheduledjobactivityFileName:
      title: ocsfv1.3.0scheduledjobactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0scheduledjobactivityHash:
      title: ocsfv1.3.0scheduledjobactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0scheduledjobactivityHostname:
      title: ocsfv1.3.0scheduledjobactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0scheduledjobactivityIPAddress:
      title: ocsfv1.3.0scheduledjobactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0scheduledjobactivityMACAddress:
      title: ocsfv1.3.0scheduledjobactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0scheduledjobactivityPort:
      title: ocsfv1.3.0scheduledjobactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0scheduledjobactivityProcessName:
      title: ocsfv1.3.0scheduledjobactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0scheduledjobactivitySubnet:
      title: ocsfv1.3.0scheduledjobactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0scheduledjobactivityTimestamp:
      title: ocsfv1.3.0scheduledjobactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0scheduledjobactivityURLString:
      title: ocsfv1.3.0scheduledjobactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0scheduledjobactivityUserName:
      title: ocsfv1.3.0scheduledjobactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0scheduledjobactivityActionId:
      title: ocsfv1.3.0scheduledjobactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Count',
        'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        99 - Other: The action was not mapped. See the <code>action</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityActivityId:
      title: ocsfv1.3.0scheduledjobactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create

        2 - Update

        3 - Delete

        4 - Enable

        5 - Disable

        6 - Start

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityCategoryUid:
      title: ocsfv1.3.0scheduledjobactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        1 - SystemActivity: System Activity events.
    ocsfv1.3.0scheduledjobactivityClassUid:
      title: ocsfv1.3.0scheduledjobactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        1006 - ScheduledJobActivity: Scheduled Job Activity events report
        activities related to scheduled jobs or tasks.
    ocsfv1.3.0scheduledjobactivityDispositionId:
      title: ocsfv1.3.0scheduledjobactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityScheduledJobActivity:
      title: ocsfv1.3.0scheduledjobactivityScheduledJobActivity
      type: object
      description: >-
        Scheduled Job Activity events report activities related to scheduled
        jobs or tasks.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. Dispositions conform to an action of
            <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases.
            Note that <code>99</code> 'Other' is not an option. No action would
            equate to <code>1</code> 'Allowed'. An unknown action may still
            correspond to a known disposition. Refer to
            <code>disposition_id</code> for the outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityActor'
          nullable: true
          description: >-
            The actor that performed the activity on the <code>job</code>
            object.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>System Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDevice'
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFirewallRule'
          nullable: true
          description: The firewall rule that triggered the event.
        job:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityJob'
          description: The job object that pertains to the event.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - device
        - job
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0scheduledjobactivitySeverityId:
      title: ocsfv1.3.0scheduledjobactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scheduledjobactivityStatusId:
      title: ocsfv1.3.0scheduledjobactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityTypeUid:
      title: ocsfv1.3.0scheduledjobactivityTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        100600 - Unknown
        100601 - Create
        100602 - Update
        100603 - Delete
        100604 - Enable
        100605 - Disable
        100606 - Start
        100699 - Other
    ocsfv1.3.0scheduledjobactivityAccount:
      title: ocsfv1.3.0scheduledjobactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0scheduledjobactivityAccount_TypeId:
      title: ocsfv1.3.0scheduledjobactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0scheduledjobactivityActor:
      title: ocsfv1.3.0scheduledjobactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0scheduledjobactivityActor_ActorTypeId:
      title: ocsfv1.3.0scheduledjobactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityAffectedCode:
      title: ocsfv1.3.0scheduledjobactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0scheduledjobactivityAffectedPackage:
      title: ocsfv1.3.0scheduledjobactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0scheduledjobactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0scheduledjobactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityAgent:
      title: ocsfv1.3.0scheduledjobactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0scheduledjobactivityAgent_TypeId:
      title: ocsfv1.3.0scheduledjobactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityApi:
      title: ocsfv1.3.0scheduledjobactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0scheduledjobactivityAttack:
      title: ocsfv1.3.0scheduledjobactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0scheduledjobactivityAuthorization:
      title: ocsfv1.3.0scheduledjobactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0scheduledjobactivityAutonomousSystem:
      title: ocsfv1.3.0scheduledjobactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0scheduledjobactivityCertificate:
      title: ocsfv1.3.0scheduledjobactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0scheduledjobactivityCloud:
      title: ocsfv1.3.0scheduledjobactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0scheduledjobactivityContainer:
      title: ocsfv1.3.0scheduledjobactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0scheduledjobactivityCve:
      title: ocsfv1.3.0scheduledjobactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0scheduledjobactivityCvss:
      title: ocsfv1.3.0scheduledjobactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0scheduledjobactivityCvss_Depth:
      title: ocsfv1.3.0scheduledjobactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0scheduledjobactivityCwe:
      title: ocsfv1.3.0scheduledjobactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0scheduledjobactivityDevice:
      title: ocsfv1.3.0scheduledjobactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0scheduledjobactivityNetworkInterface
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0scheduledjobactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0scheduledjobactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0scheduledjobactivityDevice_RiskLevelId:
      title: ocsfv1.3.0scheduledjobactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scheduledjobactivityDevice_TypeId:
      title: ocsfv1.3.0scheduledjobactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0scheduledjobactivityDeviceHwInfo:
      title: ocsfv1.3.0scheduledjobactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0scheduledjobactivityDigitalSignature:
      title: ocsfv1.3.0scheduledjobactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0scheduledjobactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0scheduledjobactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityDigitalSignature_StateId:
      title: ocsfv1.3.0scheduledjobactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityDisplay:
      title: ocsfv1.3.0scheduledjobactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0scheduledjobactivityDnsAnswer:
      title: ocsfv1.3.0scheduledjobactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0scheduledjobactivityDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0scheduledjobactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0scheduledjobactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityDomainContact:
      title: ocsfv1.3.0scheduledjobactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0scheduledjobactivityDomainContact_TypeId:
      title: ocsfv1.3.0scheduledjobactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityEmail:
      title: ocsfv1.3.0scheduledjobactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0scheduledjobactivityEmailAuth:
      title: ocsfv1.3.0scheduledjobactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0scheduledjobactivityEnrichment:
      title: ocsfv1.3.0scheduledjobactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0scheduledjobactivityEpss:
      title: ocsfv1.3.0scheduledjobactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0scheduledjobactivityExtension:
      title: ocsfv1.3.0scheduledjobactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0scheduledjobactivityFeature:
      title: ocsfv1.3.0scheduledjobactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0scheduledjobactivityFile:
      title: ocsfv1.3.0scheduledjobactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0scheduledjobactivityFile_ConfidentialityId:
      title: ocsfv1.3.0scheduledjobactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityFile_TypeId:
      title: ocsfv1.3.0scheduledjobactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityFingerprint:
      title: ocsfv1.3.0scheduledjobactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0scheduledjobactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0scheduledjobactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityFirewallRule:
      title: ocsfv1.3.0scheduledjobactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.3.0scheduledjobactivityGroup:
      title: ocsfv1.3.0scheduledjobactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0scheduledjobactivityIdp:
      title: ocsfv1.3.0scheduledjobactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0scheduledjobactivityImage:
      title: ocsfv1.3.0scheduledjobactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0scheduledjobactivityJob:
      title: ocsfv1.3.0scheduledjobactivityJob
      type: object
      description: >-
        The Job object provides information about a scheduled job or task,
        including its name, command line, and state. It encompasses attributes
        that describe the properties and status of the scheduled job.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: The job command line.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the job was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the job was created.
        desc:
          type: string
          nullable: true
          description: The description of the job.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFile'
          description: The file that pertains to the job.
        last_run_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the job was last run.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the job was last run.
        name:
          type: string
          description: The name of the job.
        next_run_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the job will next be run.
        next_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the job will next be run.
        run_state:
          type: string
          nullable: true
          description: The run state of the job.
        run_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityJob_RunStateId'
          nullable: true
          description: The run state ID of the job.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: The user that created the job.
      required:
        - file
        - name
    ocsfv1.3.0scheduledjobactivityJob_RunStateId:
      title: ocsfv1.3.0scheduledjobactivityJob_RunStateId
      type: integer
      description: >-
        JobRunStateId is an enum, and the following values are allowed.

        0 - Unknown: The run state is unknown.

        1 - Ready

        2 - Queued

        3 - Running

        4 - Stopped

        99 - Other: The run state is not mapped. See the <code>run_state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityKbArticle:
      title: ocsfv1.3.0scheduledjobactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0scheduledjobactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0scheduledjobactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityKeyboardInfo:
      title: ocsfv1.3.0scheduledjobactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0scheduledjobactivityKillChainPhase:
      title: ocsfv1.3.0scheduledjobactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0scheduledjobactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0scheduledjobactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scheduledjobactivityLdapPerson:
      title: ocsfv1.3.0scheduledjobactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0scheduledjobactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0scheduledjobactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityLocation:
      title: ocsfv1.3.0scheduledjobactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0scheduledjobactivityLogger:
      title: ocsfv1.3.0scheduledjobactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0scheduledjobactivityMalware:
      title: ocsfv1.3.0scheduledjobactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0scheduledjobactivityMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0scheduledjobactivityMalware_ClassificationIds:
      title: ocsfv1.3.0scheduledjobactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityMetadata:
      title: ocsfv1.3.0scheduledjobactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0scheduledjobactivityMetric:
      title: ocsfv1.3.0scheduledjobactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0scheduledjobactivityNetworkInterface:
      title: ocsfv1.3.0scheduledjobactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0scheduledjobactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0scheduledjobactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityObject:
      title: ocsfv1.3.0scheduledjobactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0scheduledjobactivityObservable:
      title: ocsfv1.3.0scheduledjobactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0scheduledjobactivityObservable_TypeId:
      title: ocsfv1.3.0scheduledjobactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0scheduledjobactivityOrganization:
      title: ocsfv1.3.0scheduledjobactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0scheduledjobactivityOs:
      title: ocsfv1.3.0scheduledjobactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0scheduledjobactivityOs_TypeId:
      title: ocsfv1.3.0scheduledjobactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0scheduledjobactivityOsint:
      title: ocsfv1.3.0scheduledjobactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0scheduledjobactivityDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0scheduledjobactivityOsint_ConfidenceId:
      title: ocsfv1.3.0scheduledjobactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityOsint_Tlp:
      title: ocsfv1.3.0scheduledjobactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0scheduledjobactivityOsint_TypeId:
      title: ocsfv1.3.0scheduledjobactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0scheduledjobactivityPackage:
      title: ocsfv1.3.0scheduledjobactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0scheduledjobactivityPackage_TypeId:
      title: ocsfv1.3.0scheduledjobactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityPolicy:
      title: ocsfv1.3.0scheduledjobactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0scheduledjobactivityProcess:
      title: ocsfv1.3.0scheduledjobactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0scheduledjobactivityProcess_IntegrityId:
      title: ocsfv1.3.0scheduledjobactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scheduledjobactivityProduct:
      title: ocsfv1.3.0scheduledjobactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0scheduledjobactivityRemediation:
      title: ocsfv1.3.0scheduledjobactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0scheduledjobactivityReputation:
      title: ocsfv1.3.0scheduledjobactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0scheduledjobactivityReputation_ScoreId:
      title: ocsfv1.3.0scheduledjobactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scheduledjobactivityRequest:
      title: ocsfv1.3.0scheduledjobactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0scheduledjobactivityResponse:
      title: ocsfv1.3.0scheduledjobactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0scheduledjobactivityService:
      title: ocsfv1.3.0scheduledjobactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0scheduledjobactivitySession:
      title: ocsfv1.3.0scheduledjobactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0scheduledjobactivitySubTechnique:
      title: ocsfv1.3.0scheduledjobactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0scheduledjobactivityTactic:
      title: ocsfv1.3.0scheduledjobactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0scheduledjobactivityTechnique:
      title: ocsfv1.3.0scheduledjobactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0scheduledjobactivityTimespan:
      title: ocsfv1.3.0scheduledjobactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0scheduledjobactivityTimespan_TypeId:
      title: ocsfv1.3.0scheduledjobactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityUrl:
      title: ocsfv1.3.0scheduledjobactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0scheduledjobactivityUrl_CategoryIds:
      title: ocsfv1.3.0scheduledjobactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0scheduledjobactivityUser:
      title: ocsfv1.3.0scheduledjobactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0scheduledjobactivityUser_MfaStatusId:
      title: ocsfv1.3.0scheduledjobactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityUser_RiskLevelId:
      title: ocsfv1.3.0scheduledjobactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0scheduledjobactivityUser_TypeId:
      title: ocsfv1.3.0scheduledjobactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0scheduledjobactivityUser_UserStatusId:
      title: ocsfv1.3.0scheduledjobactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0scheduledjobactivityVulnerability:
      title: ocsfv1.3.0scheduledjobactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0scheduledjobactivityWhois:
      title: ocsfv1.3.0scheduledjobactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0scheduledjobactivityWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0scheduledjobactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0scheduledjobactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0scheduledjobactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingEmailAddress:
      title: ocsfv1.3.0securityfindingEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0securityfindingFileName:
      title: ocsfv1.3.0securityfindingFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0securityfindingHash:
      title: ocsfv1.3.0securityfindingHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0securityfindingHostname:
      title: ocsfv1.3.0securityfindingHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0securityfindingIPAddress:
      title: ocsfv1.3.0securityfindingIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0securityfindingMACAddress:
      title: ocsfv1.3.0securityfindingMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0securityfindingPort:
      title: ocsfv1.3.0securityfindingPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0securityfindingProcessName:
      title: ocsfv1.3.0securityfindingProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0securityfindingSubnet:
      title: ocsfv1.3.0securityfindingSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0securityfindingTimestamp:
      title: ocsfv1.3.0securityfindingTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0securityfindingURLString:
      title: ocsfv1.3.0securityfindingURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0securityfindingUserName:
      title: ocsfv1.3.0securityfindingUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0securityfindingActivityId:
      title: ocsfv1.3.0securityfindingActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A security finding was created.

        2 - Update: A security finding was updated.

        3 - Close: A security finding was closed.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingCategoryUid:
      title: ocsfv1.3.0securityfindingCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        2 - Findings: Findings events report findings, detections, and possible
        resolutions of malware, anomalies, or other actions performed by
        security products.
    ocsfv1.3.0securityfindingClassUid:
      title: ocsfv1.3.0securityfindingClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        2001 - SecurityFinding: Security Finding events describe findings,
        detections, anomalies, alerts and/or actions performed by security
        products
    ocsfv1.3.0securityfindingConfidenceId:
      title: ocsfv1.3.0securityfindingConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingImpactId:
      title: ocsfv1.3.0securityfindingImpactId
      type: integer
      description: >-
        ImpactId is an enum, and the following values are allowed.

        0 - Unknown: The normalized impact is unknown.

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The impact is not mapped. See the <code>impact</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingRiskLevelId:
      title: ocsfv1.3.0securityfindingRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingSecurityFinding:
      title: ocsfv1.3.0securityfindingSecurityFinding
      type: object
      description: >-
        Security Finding events describe findings, detections, anomalies, alerts
        and/or actions performed by security products
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        analytic:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAnalytic'
          nullable: true
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAttack'
          nullable: true
          description: >-
            The attack object describes the technique and associated tactics as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK
            Matrix<sup>TM</sup></a>.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Findings</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCategoryUid'
          description: The category unique identifier of the event.
        cis_csc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingCisCsc'
          nullable: true
          description: >-
            The CIS Critical Security Controls is a list of top 20 actions and
            practices an organization’s security team can take on such that
            cyber attacks or malware, are minimized and prevented.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        compliance:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCompliance'
          nullable: true
          description: >-
            The compliance object provides context to compliance findings (e.g.,
            a check against a specific regulatory or best practice framework
            such as CIS, NIST etc.) and contains compliance related details.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: A list of custom fields
        data_sources:
          type: array
          items:
            type: string
          nullable: true
          description: A list of data sources utilized in generation of the finding.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        evidence:
          nullable: true
          description: The data the finding exposes to the analyst.
        finding:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFinding'
          description: >-
            The Finding object provides details about a finding/detection
            generated by a security tool.
        impact:
          type: string
          nullable: true
          description: >-
            The impact , normalized to the caption of the impact_id value. In
            the case of 'Other', it is defined by the event source.
        impact_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingImpactId'
          nullable: true
          description: The normalized impact of the finding.
        impact_score:
          type: integer
          nullable: true
          description: The impact of the finding, valid range 0-100.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingMetadata'
          description: The metadata associated with the event or a finding.
        nist:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The NIST Cybersecurity Framework recommendations for managing the
            cybersecurity risk.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProcess'
          nullable: true
          description: The process object.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingResourceDetails'
          nullable: true
          description: >-
            Describes details about resources that were affected by the
            activity/event.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingRiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        state:
          type: string
          nullable: true
          description: The normalized state of a security finding.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingStateId'
          description: The normalized state identifier of a security finding.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingVulnerability'
          nullable: true
          description: >-
            This object describes vulnerabilities reported in a security
            finding.
      required:
        - activity_id
        - category_uid
        - class_uid
        - finding
        - metadata
        - severity_id
        - state_id
        - time
        - type_uid
    ocsfv1.3.0securityfindingSeverityId:
      title: ocsfv1.3.0securityfindingSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingStateId:
      title: ocsfv1.3.0securityfindingStateId
      type: integer
      description: >-
        StateId is an enum, and the following values are allowed.

        0 - Unknown: The state is unknown.

        1 - New: The finding is new and yet to be reviewed.

        2 - InProgress: The finding is under review.

        3 - Suppressed: The finding was reviewed, considered as a false positive
        and is now suppressed.

        4 - Resolved: The finding was reviewed and remediated and is now
        considered resolved.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingStatusId:
      title: ocsfv1.3.0securityfindingStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingTypeUid:
      title: ocsfv1.3.0securityfindingTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        200100 - Unknown
        200101 - Create: A security finding was created.
        200102 - Update: A security finding was updated.
        200103 - Close: A security finding was closed.
        200199 - Other
    ocsfv1.3.0securityfindingAccount:
      title: ocsfv1.3.0securityfindingAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0securityfindingAccount_TypeId:
      title: ocsfv1.3.0securityfindingAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0securityfindingAffectedCode:
      title: ocsfv1.3.0securityfindingAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0securityfindingAffectedPackage:
      title: ocsfv1.3.0securityfindingAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0securityfindingAffectedPackage_TypeId:
      title: ocsfv1.3.0securityfindingAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingAgent:
      title: ocsfv1.3.0securityfindingAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0securityfindingAgent_TypeId:
      title: ocsfv1.3.0securityfindingAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingAnalytic:
      title: ocsfv1.3.0securityfindingAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.3.0securityfindingAnalytic_TypeId:
      title: ocsfv1.3.0securityfindingAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingApi:
      title: ocsfv1.3.0securityfindingApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0securityfindingAttack:
      title: ocsfv1.3.0securityfindingAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0securityfindingAutonomousSystem:
      title: ocsfv1.3.0securityfindingAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0securityfindingCertificate:
      title: ocsfv1.3.0securityfindingCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0securityfindingCisCsc:
      title: ocsfv1.3.0securityfindingCisCsc
      type: object
      description: >-
        The CIS Critical Security Control (CSC) contains information as defined
        by the Center for Internet Security Critical Security Control <a
        target="_blank" href="https://www.cisecurity.org/controls">(CIS
        CSC)</a>. Prioritized set of actions to protect your organization and
        data from cyber-attack vectors.
      properties:
        control:
          type: string
          description: >-
            A Control is prescriptive, prioritized, and simplified set of best
            practices that one can use to strengthen their cybersecurity
            posture. e.g. AWS SecurityHub Controls, CIS Controls.
        version:
          type: string
          nullable: true
          description: The CIS critical security control version.
      required:
        - control
    ocsfv1.3.0securityfindingCloud:
      title: ocsfv1.3.0securityfindingCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0securityfindingCompliance:
      title: ocsfv1.3.0securityfindingCompliance
      type: object
      description: >-
        The Compliance object contains information about Industry and Regulatory
        Framework standards, controls and requirements.
      properties:
        compliance_references:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKbArticle'
          nullable: true
          description: >-
            A list of sources of information or tools that help organizations
            understand, interpret, and implement compliance standards. They
            provide guidance, best practices, and examples.
        compliance_standards:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKbArticle'
          nullable: true
          description: >-
            A list of established guidelines or criteria that define specific
            requirements an organization must follow.
        control:
          type: string
          nullable: true
          description: >-
            A Control is prescriptive, prioritized, and simplified set of best
            practices that one can use to strengthen their cybersecurity
            posture. e.g. AWS SecurityHub Controls, CIS Controls.
        requirements:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of requirements associated to a specific control in an
            industry or regulatory framework. e.g. <code> NIST.800-53.r5 AU-10
            </code>
        standards:
          type: array
          items:
            type: string
          description: >-
            Security standards are a set of criteria organizations can follow to
            protect sensitive and confidential information. e.g. <code>NIST SP
            800-53, CIS AWS Foundations Benchmark v1.4.0, ISO/IEC 27001</code>
        status:
          type: string
          nullable: true
          description: >-
            The resultant status of the compliance check normalized to the
            caption of the <code>status_id</code> value. In the case of 'Other',
            it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: The resultant status code of the compliance check.
        status_detail:
          type: string
          nullable: true
          description: The contextual description of the status, status_code values.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCompliance_StatusId'
          nullable: true
          description: The normalized status identifier of the compliance check.
      required:
        - standards
    ocsfv1.3.0securityfindingCompliance_StatusId:
      title: ocsfv1.3.0securityfindingCompliance_StatusId
      type: integer
      description: >-
        ComplianceStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Pass: The compliance check passed for all the evaluated resources.

        2 - Warning: The compliance check did not yield a result due to missing
        information.

        3 - Fail: The compliance check failed for at least one of the evaluated
        resources.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingContainer:
      title: ocsfv1.3.0securityfindingContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0securityfindingCve:
      title: ocsfv1.3.0securityfindingCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0securityfindingCvss:
      title: ocsfv1.3.0securityfindingCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0securityfindingCvss_Depth:
      title: ocsfv1.3.0securityfindingCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0securityfindingCwe:
      title: ocsfv1.3.0securityfindingCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0securityfindingDevice:
      title: ocsfv1.3.0securityfindingDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0securityfindingDevice_NetworkStatusId:
      title: ocsfv1.3.0securityfindingDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0securityfindingDevice_RiskLevelId:
      title: ocsfv1.3.0securityfindingDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingDevice_TypeId:
      title: ocsfv1.3.0securityfindingDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0securityfindingDeviceHwInfo:
      title: ocsfv1.3.0securityfindingDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0securityfindingDigitalSignature:
      title: ocsfv1.3.0securityfindingDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0securityfindingDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0securityfindingDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0securityfindingDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0securityfindingDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingDigitalSignature_StateId:
      title: ocsfv1.3.0securityfindingDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingDisplay:
      title: ocsfv1.3.0securityfindingDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0securityfindingDnsAnswer:
      title: ocsfv1.3.0securityfindingDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0securityfindingDnsAnswer_FlagIds:
      title: ocsfv1.3.0securityfindingDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingDomainContact:
      title: ocsfv1.3.0securityfindingDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0securityfindingDomainContact_TypeId:
      title: ocsfv1.3.0securityfindingDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingEmail:
      title: ocsfv1.3.0securityfindingEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0securityfindingEmailAuth:
      title: ocsfv1.3.0securityfindingEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0securityfindingEnrichment:
      title: ocsfv1.3.0securityfindingEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0securityfindingEpss:
      title: ocsfv1.3.0securityfindingEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0securityfindingExtension:
      title: ocsfv1.3.0securityfindingExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0securityfindingFeature:
      title: ocsfv1.3.0securityfindingFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0securityfindingFile:
      title: ocsfv1.3.0securityfindingFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0securityfindingFile_ConfidentialityId:
      title: ocsfv1.3.0securityfindingFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingFile_TypeId:
      title: ocsfv1.3.0securityfindingFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingFinding:
      title: ocsfv1.3.0securityfindingFinding
      type: object
      description: >-
        The Finding object describes metadata related to a security finding
        generated by a security tool or system.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was created.
        desc:
          type: string
          nullable: true
          description: The description of the reported finding.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the finding was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was first observed.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the finding was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was most recently observed.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was last modified.
        product_uid:
          type: string
          nullable: true
          description: The unique identifier of the product that reported the finding.
        related_events:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingRelatedEvent'
          nullable: true
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: The URL pointing to the source of the finding.
        supporting_data:
          nullable: true
          description: Additional data supporting a finding as provided by security tool
        title:
          type: string
          description: A title or a brief phrase summarizing the reported finding.
        types:
          type: array
          items:
            type: string
          nullable: true
          description: One or more types of the reported finding.
        uid:
          type: string
          description: The unique identifier of the reported finding.
      required:
        - title
        - uid
    ocsfv1.3.0securityfindingFingerprint:
      title: ocsfv1.3.0securityfindingFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0securityfindingFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0securityfindingFingerprint_AlgorithmId:
      title: ocsfv1.3.0securityfindingFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0securityfindingGroup:
      title: ocsfv1.3.0securityfindingGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0securityfindingImage:
      title: ocsfv1.3.0securityfindingImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0securityfindingKbArticle:
      title: ocsfv1.3.0securityfindingKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0securityfindingKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0securityfindingKbArticle_InstallStateId:
      title: ocsfv1.3.0securityfindingKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingKeyboardInfo:
      title: ocsfv1.3.0securityfindingKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0securityfindingKillChainPhase:
      title: ocsfv1.3.0securityfindingKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0securityfindingKillChainPhase_PhaseId:
      title: ocsfv1.3.0securityfindingKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingLdapPerson:
      title: ocsfv1.3.0securityfindingLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0securityfindingLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0securityfindingLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0securityfindingLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingLocation:
      title: ocsfv1.3.0securityfindingLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0securityfindingLogger:
      title: ocsfv1.3.0securityfindingLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0securityfindingMalware:
      title: ocsfv1.3.0securityfindingMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0securityfindingMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.3.0securityfindingMalware_ClassificationIds:
      title: ocsfv1.3.0securityfindingMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingMetadata:
      title: ocsfv1.3.0securityfindingMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0securityfindingMetric:
      title: ocsfv1.3.0securityfindingMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0securityfindingNetworkInterface:
      title: ocsfv1.3.0securityfindingNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0securityfindingNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0securityfindingNetworkInterface_TypeId:
      title: ocsfv1.3.0securityfindingNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingObject:
      title: ocsfv1.3.0securityfindingObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0securityfindingObservable:
      title: ocsfv1.3.0securityfindingObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0securityfindingObservable_TypeId:
      title: ocsfv1.3.0securityfindingObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0securityfindingOrganization:
      title: ocsfv1.3.0securityfindingOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0securityfindingOs:
      title: ocsfv1.3.0securityfindingOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0securityfindingOs_TypeId:
      title: ocsfv1.3.0securityfindingOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0securityfindingOsint:
      title: ocsfv1.3.0securityfindingOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0securityfindingOsint_ConfidenceId:
      title: ocsfv1.3.0securityfindingOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingOsint_Tlp:
      title: ocsfv1.3.0securityfindingOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0securityfindingOsint_TypeId:
      title: ocsfv1.3.0securityfindingOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0securityfindingPackage:
      title: ocsfv1.3.0securityfindingPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0securityfindingPackage_TypeId:
      title: ocsfv1.3.0securityfindingPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingProcess:
      title: ocsfv1.3.0securityfindingProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0securityfindingProcess_IntegrityId:
      title: ocsfv1.3.0securityfindingProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingProduct:
      title: ocsfv1.3.0securityfindingProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0securityfindingRelatedEvent:
      title: ocsfv1.3.0securityfindingRelatedEvent
      type: object
      description: The Related Event object describes an OCSF event related to a finding.
      properties:
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        product_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the product that reported the related
            event.
        type:
          type: string
          nullable: true
          description: >-
            The type of the related event, as defined by <code>type_uid</code>.
            <p>For example: <code>Process Activity: Launch.</code></p>
        type_name:
          type: string
          nullable: true
          description: >-
            The type of the related OCSF event, as defined by
            <code>type_uid</code>. <p>For example: <code>Process Activity:
            Launch.</code></p>
        type_uid:
          type: integer
          nullable: true
          description: >-
            The unique identifier of the related OCSF event type. <p>For
            example: <code>100701.</code></p>
        uid:
          type: string
          description: >-
            The unique identifier of the related OCSF event. This value must be
            equal to <code>metadata.uid</code> in the corresponding related
            event.
      required:
        - uid
    ocsfv1.3.0securityfindingRemediation:
      title: ocsfv1.3.0securityfindingRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0securityfindingReputation:
      title: ocsfv1.3.0securityfindingReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0securityfindingReputation_ScoreId:
      title: ocsfv1.3.0securityfindingReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingRequest:
      title: ocsfv1.3.0securityfindingRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0securityfindingResourceDetails:
      title: ocsfv1.3.0securityfindingResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0securityfindingResponse:
      title: ocsfv1.3.0securityfindingResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0securityfindingService:
      title: ocsfv1.3.0securityfindingService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0securityfindingSession:
      title: ocsfv1.3.0securityfindingSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0securityfindingSubTechnique:
      title: ocsfv1.3.0securityfindingSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0securityfindingTactic:
      title: ocsfv1.3.0securityfindingTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0securityfindingTechnique:
      title: ocsfv1.3.0securityfindingTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0securityfindingTimespan:
      title: ocsfv1.3.0securityfindingTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0securityfindingTimespan_TypeId:
      title: ocsfv1.3.0securityfindingTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingUrl:
      title: ocsfv1.3.0securityfindingUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0securityfindingUrl_CategoryIds:
      title: ocsfv1.3.0securityfindingUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0securityfindingUser:
      title: ocsfv1.3.0securityfindingUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0securityfindingUser_MfaStatusId:
      title: ocsfv1.3.0securityfindingUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingUser_RiskLevelId:
      title: ocsfv1.3.0securityfindingUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0securityfindingUser_TypeId:
      title: ocsfv1.3.0securityfindingUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0securityfindingUser_UserStatusId:
      title: ocsfv1.3.0securityfindingUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0securityfindingVulnerability:
      title: ocsfv1.3.0securityfindingVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0securityfindingWhois:
      title: ocsfv1.3.0securityfindingWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0securityfindingWhois_DnssecStatusId:
      title: ocsfv1.3.0securityfindingWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoEmailAddress:
      title: ocsfv1.3.0softwareinfoEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0softwareinfoFileName:
      title: ocsfv1.3.0softwareinfoFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0softwareinfoHash:
      title: ocsfv1.3.0softwareinfoHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0softwareinfoHostname:
      title: ocsfv1.3.0softwareinfoHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0softwareinfoIPAddress:
      title: ocsfv1.3.0softwareinfoIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0softwareinfoMACAddress:
      title: ocsfv1.3.0softwareinfoMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0softwareinfoPort:
      title: ocsfv1.3.0softwareinfoPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0softwareinfoSubnet:
      title: ocsfv1.3.0softwareinfoSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0softwareinfoTimestamp:
      title: ocsfv1.3.0softwareinfoTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0softwareinfoURLString:
      title: ocsfv1.3.0softwareinfoURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0softwareinfoUserName:
      title: ocsfv1.3.0softwareinfoUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0softwareinfoActivityId:
      title: ocsfv1.3.0softwareinfoActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Log: The discovered information is via a log.

        2 - Collect: The discovered information is via a collection process.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoCategoryUid:
      title: ocsfv1.3.0softwareinfoCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        5 - Discovery: Discovery events report the existence and state of
        devices, files, configurations, processes, registry keys, and other
        objects.
    ocsfv1.3.0softwareinfoClassUid:
      title: ocsfv1.3.0softwareinfoClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        5090 - DeviceSoftwareInfo: Device Software Info events report device
        software data that is either logged or proactively collected.
    ocsfv1.3.0softwareinfoSeverityId:
      title: ocsfv1.3.0softwareinfoSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0softwareinfoSoftwareInfo:
      title: ocsfv1.3.0softwareinfoSoftwareInfo
      type: object
      description: >-
        Device Software Info events report device software data that is either
        logged or proactively collected.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Discovery</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDevice'
          nullable: true
          description: The device that the software is loaded on.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          description: The software product that is being discovered.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - product
        - severity_id
        - time
        - type_uid
    ocsfv1.3.0softwareinfoStatusId:
      title: ocsfv1.3.0softwareinfoStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0softwareinfoTypeUid:
      title: ocsfv1.3.0softwareinfoTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        509000 - Unknown

        509001 - Log: The discovered information is via a log.

        509002 - Collect: The discovered information is via a collection
        process.

        509099 - Other
    ocsfv1.3.0softwareinfoAccount:
      title: ocsfv1.3.0softwareinfoAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0softwareinfoAccount_TypeId:
      title: ocsfv1.3.0softwareinfoAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0softwareinfoAffectedCode:
      title: ocsfv1.3.0softwareinfoAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0softwareinfoAffectedPackage:
      title: ocsfv1.3.0softwareinfoAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0softwareinfoAffectedPackage_TypeId:
      title: ocsfv1.3.0softwareinfoAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoAgent:
      title: ocsfv1.3.0softwareinfoAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0softwareinfoAgent_TypeId:
      title: ocsfv1.3.0softwareinfoAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoApi:
      title: ocsfv1.3.0softwareinfoApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0softwareinfoAttack:
      title: ocsfv1.3.0softwareinfoAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0softwareinfoAutonomousSystem:
      title: ocsfv1.3.0softwareinfoAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0softwareinfoCertificate:
      title: ocsfv1.3.0softwareinfoCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0softwareinfoCloud:
      title: ocsfv1.3.0softwareinfoCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0softwareinfoContainer:
      title: ocsfv1.3.0softwareinfoContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0softwareinfoCve:
      title: ocsfv1.3.0softwareinfoCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0softwareinfoCvss:
      title: ocsfv1.3.0softwareinfoCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0softwareinfoCvss_Depth:
      title: ocsfv1.3.0softwareinfoCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0softwareinfoCwe:
      title: ocsfv1.3.0softwareinfoCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0softwareinfoDevice:
      title: ocsfv1.3.0softwareinfoDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoNetworkInterface'
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0softwareinfoDevice_NetworkStatusId:
      title: ocsfv1.3.0softwareinfoDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0softwareinfoDevice_RiskLevelId:
      title: ocsfv1.3.0softwareinfoDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0softwareinfoDevice_TypeId:
      title: ocsfv1.3.0softwareinfoDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0softwareinfoDeviceHwInfo:
      title: ocsfv1.3.0softwareinfoDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0softwareinfoDigitalSignature:
      title: ocsfv1.3.0softwareinfoDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0softwareinfoDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0softwareinfoDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0softwareinfoDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0softwareinfoDigitalSignature_StateId:
      title: ocsfv1.3.0softwareinfoDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0softwareinfoDisplay:
      title: ocsfv1.3.0softwareinfoDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0softwareinfoDnsAnswer:
      title: ocsfv1.3.0softwareinfoDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0softwareinfoDnsAnswer_FlagIds:
      title: ocsfv1.3.0softwareinfoDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0softwareinfoDomainContact:
      title: ocsfv1.3.0softwareinfoDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0softwareinfoDomainContact_TypeId:
      title: ocsfv1.3.0softwareinfoDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoEmail:
      title: ocsfv1.3.0softwareinfoEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0softwareinfoEmailAuth:
      title: ocsfv1.3.0softwareinfoEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0softwareinfoEnrichment:
      title: ocsfv1.3.0softwareinfoEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0softwareinfoEpss:
      title: ocsfv1.3.0softwareinfoEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0softwareinfoExtension:
      title: ocsfv1.3.0softwareinfoExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0softwareinfoFeature:
      title: ocsfv1.3.0softwareinfoFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0softwareinfoFile:
      title: ocsfv1.3.0softwareinfoFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0softwareinfoFile_ConfidentialityId:
      title: ocsfv1.3.0softwareinfoFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoFile_TypeId:
      title: ocsfv1.3.0softwareinfoFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoFingerprint:
      title: ocsfv1.3.0softwareinfoFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0softwareinfoFingerprint_AlgorithmId:
      title: ocsfv1.3.0softwareinfoFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0softwareinfoGroup:
      title: ocsfv1.3.0softwareinfoGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0softwareinfoImage:
      title: ocsfv1.3.0softwareinfoImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0softwareinfoKbArticle:
      title: ocsfv1.3.0softwareinfoKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0softwareinfoKbArticle_InstallStateId:
      title: ocsfv1.3.0softwareinfoKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoKeyboardInfo:
      title: ocsfv1.3.0softwareinfoKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0softwareinfoKillChainPhase:
      title: ocsfv1.3.0softwareinfoKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0softwareinfoKillChainPhase_PhaseId:
      title: ocsfv1.3.0softwareinfoKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0softwareinfoLdapPerson:
      title: ocsfv1.3.0softwareinfoLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0softwareinfoLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0softwareinfoLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0softwareinfoLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoLocation:
      title: ocsfv1.3.0softwareinfoLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0softwareinfoLogger:
      title: ocsfv1.3.0softwareinfoLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0softwareinfoMetadata:
      title: ocsfv1.3.0softwareinfoMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0softwareinfoMetric:
      title: ocsfv1.3.0softwareinfoMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0softwareinfoNetworkInterface:
      title: ocsfv1.3.0softwareinfoNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoNetworkInterface_TypeId'
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0softwareinfoNetworkInterface_TypeId:
      title: ocsfv1.3.0softwareinfoNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoObject:
      title: ocsfv1.3.0softwareinfoObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0softwareinfoObservable:
      title: ocsfv1.3.0softwareinfoObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0softwareinfoObservable_TypeId:
      title: ocsfv1.3.0softwareinfoObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0softwareinfoOrganization:
      title: ocsfv1.3.0softwareinfoOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0softwareinfoOs:
      title: ocsfv1.3.0softwareinfoOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0softwareinfoOs_TypeId:
      title: ocsfv1.3.0softwareinfoOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0softwareinfoOsint:
      title: ocsfv1.3.0softwareinfoOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0softwareinfoOsint_ConfidenceId:
      title: ocsfv1.3.0softwareinfoOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoOsint_Tlp:
      title: ocsfv1.3.0softwareinfoOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0softwareinfoOsint_TypeId:
      title: ocsfv1.3.0softwareinfoOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0softwareinfoPackage:
      title: ocsfv1.3.0softwareinfoPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0softwareinfoPackage_TypeId:
      title: ocsfv1.3.0softwareinfoPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoProduct:
      title: ocsfv1.3.0softwareinfoProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0softwareinfoRemediation:
      title: ocsfv1.3.0softwareinfoRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0softwareinfoReputation:
      title: ocsfv1.3.0softwareinfoReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0softwareinfoReputation_ScoreId:
      title: ocsfv1.3.0softwareinfoReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0softwareinfoRequest:
      title: ocsfv1.3.0softwareinfoRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0softwareinfoResponse:
      title: ocsfv1.3.0softwareinfoResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0softwareinfoService:
      title: ocsfv1.3.0softwareinfoService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0softwareinfoSubTechnique:
      title: ocsfv1.3.0softwareinfoSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0softwareinfoTactic:
      title: ocsfv1.3.0softwareinfoTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0softwareinfoTechnique:
      title: ocsfv1.3.0softwareinfoTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0softwareinfoTimespan:
      title: ocsfv1.3.0softwareinfoTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0softwareinfoTimespan_TypeId:
      title: ocsfv1.3.0softwareinfoTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoUrl:
      title: ocsfv1.3.0softwareinfoUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0softwareinfoUrl_CategoryIds:
      title: ocsfv1.3.0softwareinfoUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0softwareinfoUser:
      title: ocsfv1.3.0softwareinfoUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0softwareinfoUser_MfaStatusId:
      title: ocsfv1.3.0softwareinfoUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoUser_RiskLevelId:
      title: ocsfv1.3.0softwareinfoUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0softwareinfoUser_TypeId:
      title: ocsfv1.3.0softwareinfoUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0softwareinfoUser_UserStatusId:
      title: ocsfv1.3.0softwareinfoUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0softwareinfoVulnerability:
      title: ocsfv1.3.0softwareinfoVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0softwareinfoWhois:
      title: ocsfv1.3.0softwareinfoWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0softwareinfoDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0softwareinfoSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0softwareinfoWhois_DnssecStatusId:
      title: ocsfv1.3.0softwareinfoWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementEmailAddress:
      title: ocsfv1.3.0useraccessmanagementEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0useraccessmanagementFileName:
      title: ocsfv1.3.0useraccessmanagementFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0useraccessmanagementHash:
      title: ocsfv1.3.0useraccessmanagementHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0useraccessmanagementHostname:
      title: ocsfv1.3.0useraccessmanagementHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0useraccessmanagementIPAddress:
      title: ocsfv1.3.0useraccessmanagementIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0useraccessmanagementMACAddress:
      title: ocsfv1.3.0useraccessmanagementMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0useraccessmanagementPort:
      title: ocsfv1.3.0useraccessmanagementPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0useraccessmanagementProcessName:
      title: ocsfv1.3.0useraccessmanagementProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0useraccessmanagementSubnet:
      title: ocsfv1.3.0useraccessmanagementSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0useraccessmanagementTimestamp:
      title: ocsfv1.3.0useraccessmanagementTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0useraccessmanagementURLString:
      title: ocsfv1.3.0useraccessmanagementURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0useraccessmanagementUserName:
      title: ocsfv1.3.0useraccessmanagementUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0useraccessmanagementActivityId:
      title: ocsfv1.3.0useraccessmanagementActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - AssignPrivileges: Assign privileges to a user.

        2 - RevokePrivileges: Revoke privileges from a user.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementCategoryUid:
      title: ocsfv1.3.0useraccessmanagementCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        3 - AccessManagement: Identity &amp; Access Management (IAM) events
        relate to the supervision of the system's authentication and access
        control model. Examples of such events are the success or failure of
        authentication, granting of authority, password change, entity change,
        privileged use etc.
    ocsfv1.3.0useraccessmanagementClassUid:
      title: ocsfv1.3.0useraccessmanagementClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        3005 - UserAccessManagement: User Access Management events report
        management updates to a user's privileges.
    ocsfv1.3.0useraccessmanagementSeverityId:
      title: ocsfv1.3.0useraccessmanagementSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0useraccessmanagementStatusId:
      title: ocsfv1.3.0useraccessmanagementStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementTypeUid:
      title: ocsfv1.3.0useraccessmanagementTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        300500 - Unknown
        300501 - AssignPrivileges: Assign privileges to a user.
        300502 - RevokePrivileges: Revoke privileges from a user.
        300599 - Other
    ocsfv1.3.0useraccessmanagementUserAccess:
      title: ocsfv1.3.0useraccessmanagementUserAccess
      type: object
      description: >-
        User Access Management events report management updates to a user's
        privileges.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Identity &amp; Access Management</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        privileges:
          type: array
          items:
            type: string
          description: List of privileges assigned to a user.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        resource:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementResourceDetails'
          nullable: true
          description: Resource that the privileges give access to.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementNetworkEndpoint'
          nullable: true
          description: Details about the source of the IAM activity.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          description: User to which privileges were assigned.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - privileges
        - severity_id
        - time
        - type_uid
        - user
    ocsfv1.3.0useraccessmanagementAccount:
      title: ocsfv1.3.0useraccessmanagementAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0useraccessmanagementAccount_TypeId:
      title: ocsfv1.3.0useraccessmanagementAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0useraccessmanagementActor:
      title: ocsfv1.3.0useraccessmanagementActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0useraccessmanagementActor_ActorTypeId:
      title: ocsfv1.3.0useraccessmanagementActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementAffectedCode:
      title: ocsfv1.3.0useraccessmanagementAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0useraccessmanagementAffectedPackage:
      title: ocsfv1.3.0useraccessmanagementAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0useraccessmanagementAffectedPackage_TypeId:
      title: ocsfv1.3.0useraccessmanagementAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementAgent:
      title: ocsfv1.3.0useraccessmanagementAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0useraccessmanagementAgent_TypeId:
      title: ocsfv1.3.0useraccessmanagementAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementApi:
      title: ocsfv1.3.0useraccessmanagementApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0useraccessmanagementAttack:
      title: ocsfv1.3.0useraccessmanagementAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0useraccessmanagementAuthorization:
      title: ocsfv1.3.0useraccessmanagementAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0useraccessmanagementAutonomousSystem:
      title: ocsfv1.3.0useraccessmanagementAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0useraccessmanagementCertificate:
      title: ocsfv1.3.0useraccessmanagementCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0useraccessmanagementCloud:
      title: ocsfv1.3.0useraccessmanagementCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0useraccessmanagementContainer:
      title: ocsfv1.3.0useraccessmanagementContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0useraccessmanagementCve:
      title: ocsfv1.3.0useraccessmanagementCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0useraccessmanagementCvss:
      title: ocsfv1.3.0useraccessmanagementCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0useraccessmanagementCvss_Depth:
      title: ocsfv1.3.0useraccessmanagementCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0useraccessmanagementCwe:
      title: ocsfv1.3.0useraccessmanagementCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0useraccessmanagementDevice:
      title: ocsfv1.3.0useraccessmanagementDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0useraccessmanagementNetworkInterface
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0useraccessmanagementDevice_NetworkStatusId:
      title: ocsfv1.3.0useraccessmanagementDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0useraccessmanagementDevice_RiskLevelId:
      title: ocsfv1.3.0useraccessmanagementDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0useraccessmanagementDevice_TypeId:
      title: ocsfv1.3.0useraccessmanagementDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0useraccessmanagementDeviceHwInfo:
      title: ocsfv1.3.0useraccessmanagementDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0useraccessmanagementDigitalSignature:
      title: ocsfv1.3.0useraccessmanagementDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0useraccessmanagementDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0useraccessmanagementDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementDigitalSignature_StateId:
      title: ocsfv1.3.0useraccessmanagementDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementDisplay:
      title: ocsfv1.3.0useraccessmanagementDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0useraccessmanagementDnsAnswer:
      title: ocsfv1.3.0useraccessmanagementDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0useraccessmanagementDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0useraccessmanagementDnsAnswer_FlagIds:
      title: ocsfv1.3.0useraccessmanagementDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementDomainContact:
      title: ocsfv1.3.0useraccessmanagementDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0useraccessmanagementDomainContact_TypeId:
      title: ocsfv1.3.0useraccessmanagementDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementEmail:
      title: ocsfv1.3.0useraccessmanagementEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0useraccessmanagementEmailAuth:
      title: ocsfv1.3.0useraccessmanagementEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0useraccessmanagementEnrichment:
      title: ocsfv1.3.0useraccessmanagementEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0useraccessmanagementEpss:
      title: ocsfv1.3.0useraccessmanagementEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0useraccessmanagementExtension:
      title: ocsfv1.3.0useraccessmanagementExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0useraccessmanagementFeature:
      title: ocsfv1.3.0useraccessmanagementFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0useraccessmanagementFile:
      title: ocsfv1.3.0useraccessmanagementFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0useraccessmanagementFile_ConfidentialityId:
      title: ocsfv1.3.0useraccessmanagementFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementFile_TypeId:
      title: ocsfv1.3.0useraccessmanagementFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementFingerprint:
      title: ocsfv1.3.0useraccessmanagementFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0useraccessmanagementFingerprint_AlgorithmId:
      title: ocsfv1.3.0useraccessmanagementFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementGroup:
      title: ocsfv1.3.0useraccessmanagementGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0useraccessmanagementHttpHeader:
      title: ocsfv1.3.0useraccessmanagementHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0useraccessmanagementHttpRequest:
      title: ocsfv1.3.0useraccessmanagementHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementHttpRequest_HttpMethod
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0useraccessmanagementHttpRequest_HttpMethod:
      title: ocsfv1.3.0useraccessmanagementHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0useraccessmanagementIdp:
      title: ocsfv1.3.0useraccessmanagementIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0useraccessmanagementImage:
      title: ocsfv1.3.0useraccessmanagementImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0useraccessmanagementKbArticle:
      title: ocsfv1.3.0useraccessmanagementKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0useraccessmanagementKbArticle_InstallStateId:
      title: ocsfv1.3.0useraccessmanagementKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementKeyboardInfo:
      title: ocsfv1.3.0useraccessmanagementKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0useraccessmanagementKillChainPhase:
      title: ocsfv1.3.0useraccessmanagementKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0useraccessmanagementKillChainPhase_PhaseId:
      title: ocsfv1.3.0useraccessmanagementKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0useraccessmanagementLdapPerson:
      title: ocsfv1.3.0useraccessmanagementLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0useraccessmanagementLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0useraccessmanagementLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementLocation:
      title: ocsfv1.3.0useraccessmanagementLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0useraccessmanagementLogger:
      title: ocsfv1.3.0useraccessmanagementLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0useraccessmanagementMetadata:
      title: ocsfv1.3.0useraccessmanagementMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0useraccessmanagementMetric:
      title: ocsfv1.3.0useraccessmanagementMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0useraccessmanagementNetworkEndpoint:
      title: ocsfv1.3.0useraccessmanagementNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementNetworkEndpoint_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0useraccessmanagementNetworkEndpoint_TypeId:
      title: ocsfv1.3.0useraccessmanagementNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0useraccessmanagementNetworkInterface:
      title: ocsfv1.3.0useraccessmanagementNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0useraccessmanagementNetworkInterface_TypeId:
      title: ocsfv1.3.0useraccessmanagementNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementNetworkProxy:
      title: ocsfv1.3.0useraccessmanagementNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementNetworkProxy_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0useraccessmanagementNetworkProxy_TypeId:
      title: ocsfv1.3.0useraccessmanagementNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0useraccessmanagementObject:
      title: ocsfv1.3.0useraccessmanagementObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0useraccessmanagementObservable:
      title: ocsfv1.3.0useraccessmanagementObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0useraccessmanagementObservable_TypeId:
      title: ocsfv1.3.0useraccessmanagementObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0useraccessmanagementOrganization:
      title: ocsfv1.3.0useraccessmanagementOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0useraccessmanagementOs:
      title: ocsfv1.3.0useraccessmanagementOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0useraccessmanagementOs_TypeId:
      title: ocsfv1.3.0useraccessmanagementOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0useraccessmanagementOsint:
      title: ocsfv1.3.0useraccessmanagementOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0useraccessmanagementDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0useraccessmanagementOsint_ConfidenceId:
      title: ocsfv1.3.0useraccessmanagementOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementOsint_Tlp:
      title: ocsfv1.3.0useraccessmanagementOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0useraccessmanagementOsint_TypeId:
      title: ocsfv1.3.0useraccessmanagementOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0useraccessmanagementPackage:
      title: ocsfv1.3.0useraccessmanagementPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0useraccessmanagementPackage_TypeId:
      title: ocsfv1.3.0useraccessmanagementPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementPolicy:
      title: ocsfv1.3.0useraccessmanagementPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0useraccessmanagementProcess:
      title: ocsfv1.3.0useraccessmanagementProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0useraccessmanagementProcess_IntegrityId:
      title: ocsfv1.3.0useraccessmanagementProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0useraccessmanagementProduct:
      title: ocsfv1.3.0useraccessmanagementProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0useraccessmanagementRemediation:
      title: ocsfv1.3.0useraccessmanagementRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0useraccessmanagementReputation:
      title: ocsfv1.3.0useraccessmanagementReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0useraccessmanagementReputation_ScoreId:
      title: ocsfv1.3.0useraccessmanagementReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0useraccessmanagementRequest:
      title: ocsfv1.3.0useraccessmanagementRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0useraccessmanagementResourceDetails:
      title: ocsfv1.3.0useraccessmanagementResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0useraccessmanagementResponse:
      title: ocsfv1.3.0useraccessmanagementResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0useraccessmanagementService:
      title: ocsfv1.3.0useraccessmanagementService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0useraccessmanagementSession:
      title: ocsfv1.3.0useraccessmanagementSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0useraccessmanagementSubTechnique:
      title: ocsfv1.3.0useraccessmanagementSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0useraccessmanagementTactic:
      title: ocsfv1.3.0useraccessmanagementTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0useraccessmanagementTechnique:
      title: ocsfv1.3.0useraccessmanagementTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0useraccessmanagementTimespan:
      title: ocsfv1.3.0useraccessmanagementTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0useraccessmanagementTimespan_TypeId:
      title: ocsfv1.3.0useraccessmanagementTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementUrl:
      title: ocsfv1.3.0useraccessmanagementUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0useraccessmanagementUrl_CategoryIds:
      title: ocsfv1.3.0useraccessmanagementUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0useraccessmanagementUser:
      title: ocsfv1.3.0useraccessmanagementUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0useraccessmanagementUser_MfaStatusId:
      title: ocsfv1.3.0useraccessmanagementUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementUser_RiskLevelId:
      title: ocsfv1.3.0useraccessmanagementUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0useraccessmanagementUser_TypeId:
      title: ocsfv1.3.0useraccessmanagementUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0useraccessmanagementUser_UserStatusId:
      title: ocsfv1.3.0useraccessmanagementUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0useraccessmanagementVulnerability:
      title: ocsfv1.3.0useraccessmanagementVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0useraccessmanagementWhois:
      title: ocsfv1.3.0useraccessmanagementWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0useraccessmanagementWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0useraccessmanagementSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0useraccessmanagementWhois_DnssecStatusId:
      title: ocsfv1.3.0useraccessmanagementWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingEmailAddress:
      title: ocsfv1.3.0vulnerabilityfindingEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0vulnerabilityfindingFileName:
      title: ocsfv1.3.0vulnerabilityfindingFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0vulnerabilityfindingHash:
      title: ocsfv1.3.0vulnerabilityfindingHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0vulnerabilityfindingHostname:
      title: ocsfv1.3.0vulnerabilityfindingHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0vulnerabilityfindingIPAddress:
      title: ocsfv1.3.0vulnerabilityfindingIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0vulnerabilityfindingMACAddress:
      title: ocsfv1.3.0vulnerabilityfindingMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0vulnerabilityfindingPort:
      title: ocsfv1.3.0vulnerabilityfindingPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0vulnerabilityfindingProcessName:
      title: ocsfv1.3.0vulnerabilityfindingProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0vulnerabilityfindingSubnet:
      title: ocsfv1.3.0vulnerabilityfindingSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0vulnerabilityfindingTimestamp:
      title: ocsfv1.3.0vulnerabilityfindingTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0vulnerabilityfindingURLString:
      title: ocsfv1.3.0vulnerabilityfindingURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0vulnerabilityfindingUserName:
      title: ocsfv1.3.0vulnerabilityfindingUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0vulnerabilityfindingActivityId:
      title: ocsfv1.3.0vulnerabilityfindingActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A finding was created.

        2 - Update: A finding was updated.

        3 - Close: A finding was closed.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingCategoryUid:
      title: ocsfv1.3.0vulnerabilityfindingCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        2 - Findings: Findings events report findings, detections, and possible
        resolutions of malware, anomalies, or other actions performed by
        security products.
    ocsfv1.3.0vulnerabilityfindingClassUid:
      title: ocsfv1.3.0vulnerabilityfindingClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        2002 - VulnerabilityFinding: The Vulnerability Finding event is a
        notification about weakness in an information system, system security
        procedures, internal controls, or implementation that could be exploited
        or triggered by a threat source.
    ocsfv1.3.0vulnerabilityfindingConfidenceId:
      title: ocsfv1.3.0vulnerabilityfindingConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingSeverityId:
      title: ocsfv1.3.0vulnerabilityfindingSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingStatusId:
      title: ocsfv1.3.0vulnerabilityfindingStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - New: The Finding is new and yet to be reviewed.

        2 - InProgress: The Finding is under review.

        3 - Suppressed: The Finding was reviewed, determined to be benign or a
        false positive and is now suppressed.

        4 - Resolved: The Finding was reviewed, remediated and is now considered
        resolved.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingTypeUid:
      title: ocsfv1.3.0vulnerabilityfindingTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        200200 - Unknown
        200201 - Create: A finding was created.
        200202 - Update: A finding was updated.
        200203 - Close: A finding was closed.
        200299 - Other
    ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding:
      title: ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding
      type: object
      description: >-
        The Vulnerability Finding event is a notification about weakness in an
        information system, system security procedures, internal controls, or
        implementation that could be exploited or triggered by a threat source.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingActivityId'
          description: The normalized identifier of the finding activity.
        activity_name:
          type: string
          nullable: true
          description: >-
            The finding activity name, as defined by the
            <code>activity_id</code>.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Findings</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        comment:
          type: string
          nullable: true
          description: A user provided comment about the finding.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDevice'
          nullable: true
          description: >-
            Describes the affected device/host. It can be used in conjunction
            with <code>Affected Resource(s)</code>. <p> e.g. Specific details
            about an AWS EC2 instance, that is affected by the Finding.</p>
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time of the most recent event included in the finding.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the most recent event included in the finding.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        finding_info:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFindingInfo'
          description: Describes the supporting information about a generated finding.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        resource:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingResourceDetails'
          nullable: true
          description: >-
            Describes details about the resource that is affected by the
            vulnerability/vulnerabilities.
        resources:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingResourceDetails'
          nullable: true
          description: >-
            Describes details about the resource/resources that are affected by
            the vulnerability/vulnerabilities.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time of the least recent event included in the finding.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the least recent event included in the finding.
        status:
          type: string
          nullable: true
          description: >-
            The normalized status of the Finding set by the consumer normalized
            to the caption of the status_id value. In the case of 'Other', it is
            defined by the source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingStatusId'
          nullable: true
          description: >-
            The normalized status identifier of the Finding, set by the
            consumer.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerability'
          description: >-
            This object describes vulnerabilities reported in a security
            finding.
      required:
        - activity_id
        - category_uid
        - class_uid
        - finding_info
        - metadata
        - severity_id
        - time
        - type_uid
        - vulnerabilities
    ocsfv1.3.0vulnerabilityfindingAccount:
      title: ocsfv1.3.0vulnerabilityfindingAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0vulnerabilityfindingAccount_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0vulnerabilityfindingActor:
      title: ocsfv1.3.0vulnerabilityfindingActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0vulnerabilityfindingActor_ActorTypeId:
      title: ocsfv1.3.0vulnerabilityfindingActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingAffectedCode:
      title: ocsfv1.3.0vulnerabilityfindingAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0vulnerabilityfindingAffectedPackage:
      title: ocsfv1.3.0vulnerabilityfindingAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0vulnerabilityfindingAffectedPackage_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingAgent:
      title: ocsfv1.3.0vulnerabilityfindingAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0vulnerabilityfindingAgent_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingAnalytic:
      title: ocsfv1.3.0vulnerabilityfindingAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.3.0vulnerabilityfindingAnalytic_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingApi:
      title: ocsfv1.3.0vulnerabilityfindingApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0vulnerabilityfindingAttack:
      title: ocsfv1.3.0vulnerabilityfindingAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingSubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0vulnerabilityfindingAuthorization:
      title: ocsfv1.3.0vulnerabilityfindingAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0vulnerabilityfindingAutonomousSystem:
      title: ocsfv1.3.0vulnerabilityfindingAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0vulnerabilityfindingCertificate:
      title: ocsfv1.3.0vulnerabilityfindingCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint'
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0vulnerabilityfindingCloud:
      title: ocsfv1.3.0vulnerabilityfindingCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0vulnerabilityfindingContainer:
      title: ocsfv1.3.0vulnerabilityfindingContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0vulnerabilityfindingCve:
      title: ocsfv1.3.0vulnerabilityfindingCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0vulnerabilityfindingCvss:
      title: ocsfv1.3.0vulnerabilityfindingCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0vulnerabilityfindingCvss_Depth:
      title: ocsfv1.3.0vulnerabilityfindingCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0vulnerabilityfindingCwe:
      title: ocsfv1.3.0vulnerabilityfindingCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0vulnerabilityfindingDevice:
      title: ocsfv1.3.0vulnerabilityfindingDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0vulnerabilityfindingNetworkInterface
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDevice_TypeId'
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0vulnerabilityfindingDevice_NetworkStatusId:
      title: ocsfv1.3.0vulnerabilityfindingDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0vulnerabilityfindingDevice_RiskLevelId:
      title: ocsfv1.3.0vulnerabilityfindingDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingDevice_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0vulnerabilityfindingDeviceHwInfo:
      title: ocsfv1.3.0vulnerabilityfindingDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0vulnerabilityfindingDigitalSignature:
      title: ocsfv1.3.0vulnerabilityfindingDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0vulnerabilityfindingDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0vulnerabilityfindingDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingDigitalSignature_StateId:
      title: ocsfv1.3.0vulnerabilityfindingDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingDisplay:
      title: ocsfv1.3.0vulnerabilityfindingDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0vulnerabilityfindingDnsAnswer:
      title: ocsfv1.3.0vulnerabilityfindingDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0vulnerabilityfindingDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0vulnerabilityfindingDnsAnswer_FlagIds:
      title: ocsfv1.3.0vulnerabilityfindingDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingDomainContact:
      title: ocsfv1.3.0vulnerabilityfindingDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0vulnerabilityfindingDomainContact_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingEmail:
      title: ocsfv1.3.0vulnerabilityfindingEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0vulnerabilityfindingEmailAuth:
      title: ocsfv1.3.0vulnerabilityfindingEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0vulnerabilityfindingEnrichment:
      title: ocsfv1.3.0vulnerabilityfindingEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0vulnerabilityfindingEpss:
      title: ocsfv1.3.0vulnerabilityfindingEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0vulnerabilityfindingExtension:
      title: ocsfv1.3.0vulnerabilityfindingExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0vulnerabilityfindingFeature:
      title: ocsfv1.3.0vulnerabilityfindingFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0vulnerabilityfindingFile:
      title: ocsfv1.3.0vulnerabilityfindingFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint'
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0vulnerabilityfindingFile_ConfidentialityId:
      title: ocsfv1.3.0vulnerabilityfindingFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingFile_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingFindingInfo:
      title: ocsfv1.3.0vulnerabilityfindingFindingInfo
      type: object
      description: >-
        The Finding Information object describes metadata related to a security
        finding generated by a security tool or system.
      properties:
        analytic:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAnalytic'
          nullable: true
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAttack'
          nullable: true
          description: >-
            The <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> technique and associated tactics related to the
            finding.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was created.
        data_sources:
          type: array
          items:
            type: string
          nullable: true
          description: A list of data sources utilized in generation of the finding.
        desc:
          type: string
          nullable: true
          description: The description of the reported finding.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was last modified.
        product_uid:
          type: string
          nullable: true
          description: The unique identifier of the product that reported the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAnalytic'
          nullable: true
          description: Other analytics related to this finding.
        related_events:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingRelatedEvent'
          nullable: true
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: The URL pointing to the source of the finding.
        title:
          type: string
          description: A title or a brief phrase summarizing the reported finding.
        types:
          type: array
          items:
            type: string
          nullable: true
          description: One or more types of the reported finding.
        uid:
          type: string
          description: The unique identifier of the reported finding.
      required:
        - title
        - uid
    ocsfv1.3.0vulnerabilityfindingFingerprint:
      title: ocsfv1.3.0vulnerabilityfindingFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0vulnerabilityfindingFingerprint_AlgorithmId:
      title: ocsfv1.3.0vulnerabilityfindingFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingGroup:
      title: ocsfv1.3.0vulnerabilityfindingGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0vulnerabilityfindingIdp:
      title: ocsfv1.3.0vulnerabilityfindingIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0vulnerabilityfindingImage:
      title: ocsfv1.3.0vulnerabilityfindingImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0vulnerabilityfindingKbArticle:
      title: ocsfv1.3.0vulnerabilityfindingKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0vulnerabilityfindingKbArticle_InstallStateId:
      title: ocsfv1.3.0vulnerabilityfindingKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingKeyboardInfo:
      title: ocsfv1.3.0vulnerabilityfindingKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0vulnerabilityfindingKillChainPhase:
      title: ocsfv1.3.0vulnerabilityfindingKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0vulnerabilityfindingKillChainPhase_PhaseId:
      title: ocsfv1.3.0vulnerabilityfindingKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingLdapPerson:
      title: ocsfv1.3.0vulnerabilityfindingLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0vulnerabilityfindingLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0vulnerabilityfindingLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingLocation:
      title: ocsfv1.3.0vulnerabilityfindingLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0vulnerabilityfindingLogger:
      title: ocsfv1.3.0vulnerabilityfindingLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0vulnerabilityfindingMetadata:
      title: ocsfv1.3.0vulnerabilityfindingMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0vulnerabilityfindingMetric:
      title: ocsfv1.3.0vulnerabilityfindingMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0vulnerabilityfindingNetworkInterface:
      title: ocsfv1.3.0vulnerabilityfindingNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0vulnerabilityfindingNetworkInterface_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingObject:
      title: ocsfv1.3.0vulnerabilityfindingObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0vulnerabilityfindingObservable:
      title: ocsfv1.3.0vulnerabilityfindingObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0vulnerabilityfindingObservable_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingOrganization:
      title: ocsfv1.3.0vulnerabilityfindingOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0vulnerabilityfindingOs:
      title: ocsfv1.3.0vulnerabilityfindingOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0vulnerabilityfindingOs_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0vulnerabilityfindingOsint:
      title: ocsfv1.3.0vulnerabilityfindingOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0vulnerabilityfindingDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0vulnerabilityfindingOsint_ConfidenceId:
      title: ocsfv1.3.0vulnerabilityfindingOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingOsint_Tlp:
      title: ocsfv1.3.0vulnerabilityfindingOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0vulnerabilityfindingOsint_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0vulnerabilityfindingPackage:
      title: ocsfv1.3.0vulnerabilityfindingPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingPackage_TypeId'
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0vulnerabilityfindingPackage_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingPolicy:
      title: ocsfv1.3.0vulnerabilityfindingPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0vulnerabilityfindingProcess:
      title: ocsfv1.3.0vulnerabilityfindingProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0vulnerabilityfindingProcess_IntegrityId:
      title: ocsfv1.3.0vulnerabilityfindingProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingProduct:
      title: ocsfv1.3.0vulnerabilityfindingProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0vulnerabilityfindingRelatedEvent:
      title: ocsfv1.3.0vulnerabilityfindingRelatedEvent
      type: object
      description: The Related Event object describes an OCSF event related to a finding.
      properties:
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing the tactics, techniques &amp;
            sub-techniques identified by a security control or finding.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingKillChainPhase'
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        product_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the product that reported the related
            event.
        type:
          type: string
          nullable: true
          description: >-
            The type of the related event, as defined by <code>type_uid</code>.
            <p>For example: <code>Process Activity: Launch.</code></p>
        type_name:
          type: string
          nullable: true
          description: >-
            The type of the related OCSF event, as defined by
            <code>type_uid</code>. <p>For example: <code>Process Activity:
            Launch.</code></p>
        type_uid:
          type: integer
          nullable: true
          description: >-
            The unique identifier of the related OCSF event type. <p>For
            example: <code>100701.</code></p>
        uid:
          type: string
          description: >-
            The unique identifier of the related OCSF event. This value must be
            equal to <code>metadata.uid</code> in the corresponding related
            event.
      required:
        - uid
    ocsfv1.3.0vulnerabilityfindingRemediation:
      title: ocsfv1.3.0vulnerabilityfindingRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0vulnerabilityfindingReputation:
      title: ocsfv1.3.0vulnerabilityfindingReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0vulnerabilityfindingReputation_ScoreId:
      title: ocsfv1.3.0vulnerabilityfindingReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingRequest:
      title: ocsfv1.3.0vulnerabilityfindingRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0vulnerabilityfindingResourceDetails:
      title: ocsfv1.3.0vulnerabilityfindingResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.3.0vulnerabilityfindingResponse:
      title: ocsfv1.3.0vulnerabilityfindingResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0vulnerabilityfindingService:
      title: ocsfv1.3.0vulnerabilityfindingService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0vulnerabilityfindingSession:
      title: ocsfv1.3.0vulnerabilityfindingSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0vulnerabilityfindingSubTechnique:
      title: ocsfv1.3.0vulnerabilityfindingSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0vulnerabilityfindingTactic:
      title: ocsfv1.3.0vulnerabilityfindingTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0vulnerabilityfindingTechnique:
      title: ocsfv1.3.0vulnerabilityfindingTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0vulnerabilityfindingTimespan:
      title: ocsfv1.3.0vulnerabilityfindingTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0vulnerabilityfindingTimespan_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingUrl:
      title: ocsfv1.3.0vulnerabilityfindingUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0vulnerabilityfindingUrl_CategoryIds:
      title: ocsfv1.3.0vulnerabilityfindingUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0vulnerabilityfindingUser:
      title: ocsfv1.3.0vulnerabilityfindingUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0vulnerabilityfindingUser_MfaStatusId:
      title: ocsfv1.3.0vulnerabilityfindingUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingUser_RiskLevelId:
      title: ocsfv1.3.0vulnerabilityfindingUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0vulnerabilityfindingUser_TypeId:
      title: ocsfv1.3.0vulnerabilityfindingUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0vulnerabilityfindingUser_UserStatusId:
      title: ocsfv1.3.0vulnerabilityfindingUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0vulnerabilityfindingVulnerability:
      title: ocsfv1.3.0vulnerabilityfindingVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0vulnerabilityfindingWhois:
      title: ocsfv1.3.0vulnerabilityfindingWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0vulnerabilityfindingWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0vulnerabilityfindingSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0vulnerabilityfindingWhois_DnssecStatusId:
      title: ocsfv1.3.0vulnerabilityfindingWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityEmailAddress:
      title: ocsfv1.3.0webresourceaccessactivityEmailAddress
      type: string
      description: 'Email address. For example: <code>john_doe@example.com</code>.'
    ocsfv1.3.0webresourceaccessactivityFileName:
      title: ocsfv1.3.0webresourceaccessactivityFileName
      type: string
      description: 'File name. For example: <code>text-file.txt</code>.'
    ocsfv1.3.0webresourceaccessactivityHash:
      title: ocsfv1.3.0webresourceaccessactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.3.0webresourceaccessactivityHostname:
      title: ocsfv1.3.0webresourceaccessactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. A
        domain name in general is an Internet address that can be resolved
        through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.
    ocsfv1.3.0webresourceaccessactivityIPAddress:
      title: ocsfv1.3.0webresourceaccessactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.3.0webresourceaccessactivityMACAddress:
      title: ocsfv1.3.0webresourceaccessactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.
    ocsfv1.3.0webresourceaccessactivityPort:
      title: ocsfv1.3.0webresourceaccessactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.
    ocsfv1.3.0webresourceaccessactivityProcessName:
      title: ocsfv1.3.0webresourceaccessactivityProcessName
      type: string
      description: 'Process name. For example: <code>Notepad</code>.'
    ocsfv1.3.0webresourceaccessactivitySubnet:
      title: ocsfv1.3.0webresourceaccessactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>
    ocsfv1.3.0webresourceaccessactivityTimestamp:
      title: ocsfv1.3.0webresourceaccessactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example <code>1618524549901</code>.
    ocsfv1.3.0webresourceaccessactivityURLString:
      title: ocsfv1.3.0webresourceaccessactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.3.0webresourceaccessactivityUserName:
      title: ocsfv1.3.0webresourceaccessactivityUserName
      type: string
      description: 'User name. For example: <code>john_doe</code>.'
    ocsfv1.3.0webresourceaccessactivityActivityId:
      title: ocsfv1.3.0webresourceaccessactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - AccessGrant: The incoming request has permission to the web
        resource.

        2 - AccessDeny: The incoming request does not have permission to the web
        resource.

        3 - AccessRevoke: The incoming request's access has been revoked due to
        security policy enforcements.

        4 - AccessError: An error occurred during processing the request.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityCategoryUid:
      title: ocsfv1.3.0webresourceaccessactivityCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        6 - ApplicationActivity: Application Activity events report detailed
        information about the behavior of applications and services.
    ocsfv1.3.0webresourceaccessactivityClassUid:
      title: ocsfv1.3.0webresourceaccessactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        6004 - WebResourceAccessActivity: Web Resource Access Activity events
        describe successful/failed attempts to access a web resource over HTTP.
    ocsfv1.3.0webresourceaccessactivitySeverityId:
      title: ocsfv1.3.0webresourceaccessactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityStatusId:
      title: ocsfv1.3.0webresourceaccessactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityTypeUid:
      title: ocsfv1.3.0webresourceaccessactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        600400 - Unknown

        600401 - AccessGrant: The incoming request has permission to the web
        resource.

        600402 - AccessDeny: The incoming request does not have permission to
        the web resource.

        600403 - AccessRevoke: The incoming request's access has been revoked
        due to security policy enforcements.

        600404 - AccessError: An error occurred during processing the request.

        600499 - Other
    ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity:
      title: ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity
      type: object
      description: >-
        Web Resource Access Activity events describe successful/failed attempts
        to access a web resource over HTTP.
      properties:
        activity_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity.
        api:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Application Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        http_request:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpRequest'
          description: Details about the underlying HTTP request.
        http_response:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpResponse'
          nullable: true
          description: Details about the HTTP response, if available.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        proxy:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkProxy'
          nullable: true
          description: Details about the proxy service, if available.
        proxy_connection_info:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo
          nullable: true
          description: >-
            The connection information from the proxy server to the remote
            server.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_http_request:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpRequest'
          nullable: true
          description: The HTTP Request from the proxy server to the remote server.
        proxy_http_response:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpResponse'
          nullable: true
          description: The HTTP Response from the remote server to the proxy server.
        proxy_tls:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTls'
          nullable: true
          description: >-
            The TLS protocol negotiated between the proxy server and the remote
            server.
        proxy_traffic:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkTraffic
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network, from proxy to remote server at a given point of time.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkEndpoint
          nullable: true
          description: Details about the source endpoint of the request.
        start_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        tls:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTls'
          nullable: true
          description: The Transport Layer Security (TLS) attributes, if available.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        web_resources:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityWebResource
          description: Details about the resource that is the target of the activity.
      required:
        - activity_id
        - category_uid
        - class_uid
        - http_request
        - metadata
        - severity_id
        - time
        - type_uid
        - web_resources
    ocsfv1.3.0webresourceaccessactivityAccount:
      title: ocsfv1.3.0webresourceaccessactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to the account.
        name:
          type: string
          nullable: true
          description: The name of the account (e.g. GCP Account Name).
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityAccount_TypeId
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the account (e.g. AWS Account ID).
    ocsfv1.3.0webresourceaccessactivityAccount_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        99 - Other: The account type is not mapped.
    ocsfv1.3.0webresourceaccessactivityActor:
      title: ocsfv1.3.0webresourceaccessactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityActor_ActorTypeId
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityAuthorization
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.3.0webresourceaccessactivityActor_ActorTypeId:
      title: ocsfv1.3.0webresourceaccessactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityAffectedCode:
      title: ocsfv1.3.0webresourceaccessactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.3.0webresourceaccessactivityAffectedPackage:
      title: ocsfv1.3.0webresourceaccessactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0webresourceaccessactivityAffectedPackage_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityAgent:
      title: ocsfv1.3.0webresourceaccessactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.3.0webresourceaccessactivityAgent_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityApi:
      title: ocsfv1.3.0webresourceaccessactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.3.0webresourceaccessactivityAttack:
      title: ocsfv1.3.0webresourceaccessactivityAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySubTechnique'
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.3.0webresourceaccessactivityAuthorization:
      title: ocsfv1.3.0webresourceaccessactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.3.0webresourceaccessactivityAutonomousSystem:
      title: ocsfv1.3.0webresourceaccessactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.3.0webresourceaccessactivityCertificate:
      title: ocsfv1.3.0webresourceaccessactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Certificate/">d3f:Certificate</a>.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - fingerprints
        - issuer
        - serial_number
    ocsfv1.3.0webresourceaccessactivityCloud:
      title: ocsfv1.3.0webresourceaccessactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud account such as AWS
        Account ID, regions, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.3.0webresourceaccessactivityContainer:
      title: ocsfv1.3.0webresourceaccessactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.3.0webresourceaccessactivityCve:
      title: ocsfv1.3.0webresourceaccessactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.3.0webresourceaccessactivityCvss:
      title: ocsfv1.3.0webresourceaccessactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.3.0webresourceaccessactivityCvss_Depth:
      title: ocsfv1.3.0webresourceaccessactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.3.0webresourceaccessactivityCwe:
      title: ocsfv1.3.0webresourceaccessactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.3.0webresourceaccessactivityDevice:
      title: ocsfv1.3.0webresourceaccessactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Host/">d3f:Host</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Station Equipment Identifier that is
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkInterface
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDevice_TypeId
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.3.0webresourceaccessactivityDevice_NetworkStatusId:
      title: ocsfv1.3.0webresourceaccessactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.3.0webresourceaccessactivityDevice_RiskLevelId:
      title: ocsfv1.3.0webresourceaccessactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityDevice_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0webresourceaccessactivityDeviceHwInfo:
      title: ocsfv1.3.0webresourceaccessactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
    ocsfv1.3.0webresourceaccessactivityDigitalSignature:
      title: ocsfv1.3.0webresourceaccessactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.3.0webresourceaccessactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.3.0webresourceaccessactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityDigitalSignature_StateId:
      title: ocsfv1.3.0webresourceaccessactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityDisplay:
      title: ocsfv1.3.0webresourceaccessactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.3.0webresourceaccessactivityDnsAnswer:
      title: ocsfv1.3.0webresourceaccessactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.3.0webresourceaccessactivityDnsAnswer_FlagIds:
      title: ocsfv1.3.0webresourceaccessactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityDomainContact:
      title: ocsfv1.3.0webresourceaccessactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.3.0webresourceaccessactivityDomainContact_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityEmail:
      title: ocsfv1.3.0webresourceaccessactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress
          nullable: true
          description: The email header Cc values, as defined by RFC 5322.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          nullable: true
          description: The <strong>Delivered-To</strong> email header field.
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFile'
          nullable: true
          description: The files that are part of the event or object.
        from:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          description: The email header From values, as defined by RFC 5322.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-Id value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          nullable: true
          description: The email header Reply-To values, as defined by RFC 5322.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress
          description: The email header To values, as defined by RFC 5322.
        uid:
          type: string
          nullable: true
          description: The email unique identifier.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
      required:
        - from
        - to
    ocsfv1.3.0webresourceaccessactivityEmailAuth:
      title: ocsfv1.3.0webresourceaccessactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.3.0webresourceaccessactivityEnrichment:
      title: ocsfv1.3.0webresourceaccessactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.3.0webresourceaccessactivityEpss:
      title: ocsfv1.3.0webresourceaccessactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.3.0webresourceaccessactivityExtension:
      title: ocsfv1.3.0webresourceaccessactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.3.0webresourceaccessactivityFeature:
      title: ocsfv1.3.0webresourceaccessactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.3.0webresourceaccessactivityFile:
      title: ocsfv1.3.0webresourceaccessactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
        Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint
          nullable: true
          description: An array of hash attributes.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityDigitalSignature
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFile_TypeId'
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUrl'
          nullable: true
          description: >-
            The URL object that pertains to the event or object. See specific
            usage.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.3.0webresourceaccessactivityFile_ConfidentialityId:
      title: ocsfv1.3.0webresourceaccessactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityFile_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityFingerprint:
      title: ocsfv1.3.0webresourceaccessactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.3.0webresourceaccessactivityFingerprint_AlgorithmId:
      title: ocsfv1.3.0webresourceaccessactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityGroup:
      title: ocsfv1.3.0webresourceaccessactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.3.0webresourceaccessactivityHttpHeader:
      title: ocsfv1.3.0webresourceaccessactivityHttpHeader
      type: object
      description: >-
        TThe HTTP Header object represents the headers sent in an HTTP request
        or response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the header
        value:
          type: string
          description: The value of the header
      required:
        - name
        - value
    ocsfv1.3.0webresourceaccessactivityHttpRequest:
      title: ocsfv1.3.0webresourceaccessactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpRequest_HttpMethod
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The HTTP request length, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.3.0webresourceaccessactivityHttpRequest_HttpMethod:
      title: ocsfv1.3.0webresourceaccessactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.3.0webresourceaccessactivityHttpResponse:
      title: ocsfv1.3.0webresourceaccessactivityHttpResponse
      type: object
      description: >-
        The HTTP Response object contains detailed information about the
        response sent from a web server to the requester. It encompasses
        attributes and metadata that describe the response status, headers, body
        content, and other relevant information.
      properties:
        code:
          type: integer
          description: >-
            The Hypertext Transfer Protocol (HTTP) status code returned from the
            web server to the client. For example, 200.
        content_type:
          type: string
          nullable: true
          description: >-
            The request header that identifies the original <a target="_blank"
            href="https://www.iana.org/assignments/media-types/media-types.xhtml">media
            type </a> of the resource (prior to any content encoding applied for
            sending).
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        latency:
          type: integer
          nullable: true
          description: The HTTP response latency measured in milliseconds.
        length:
          type: integer
          nullable: true
          description: The HTTP response length, in number of bytes.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        status:
          type: string
          nullable: true
          description: >-
            The response status. For example: A successful HTTP status of 'OK'
            which corresponds to a code of 200.
      required:
        - code
    ocsfv1.3.0webresourceaccessactivityIdp:
      title: ocsfv1.3.0webresourceaccessactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the identity provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the identity provider.
    ocsfv1.3.0webresourceaccessactivityImage:
      title: ocsfv1.3.0webresourceaccessactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ContainerImage/">d3f:ContainerImage</a>.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The image labels.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.3.0webresourceaccessactivityKbArticle:
      title: ocsfv1.3.0webresourceaccessactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.3.0webresourceaccessactivityKbArticle_InstallStateId:
      title: ocsfv1.3.0webresourceaccessactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityKeyboardInfo:
      title: ocsfv1.3.0webresourceaccessactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.3.0webresourceaccessactivityKillChainPhase:
      title: ocsfv1.3.0webresourceaccessactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.3.0webresourceaccessactivityKillChainPhase_PhaseId:
      title: ocsfv1.3.0webresourceaccessactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityLdapPerson:
      title: ocsfv1.3.0webresourceaccessactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
    ocsfv1.3.0webresourceaccessactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.3.0webresourceaccessactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityLocation:
      title: ocsfv1.3.0webresourceaccessactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.
      properties:
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code. For the complete list of
            country codes see <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.<p><b>Note:</b> The two letter country code should
            be capitalized. For example: <code>US</code> or <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. Region codes are defined at
            <a target="_blank"
            href="https://www.iso.org/iso-3166-country-codes.html">ISO
            3166-2</a> and have a limit of three characters. For example, see <a
            target="_blank"
            href="https://www.iso.org/obp/ui/#iso:code:3166:US">the region codes
            for the US</a>.
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.3.0webresourceaccessactivityLogger:
      title: ocsfv1.3.0webresourceaccessactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDevice'
          nullable: true
          description: The device where the events are logged.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.3.0webresourceaccessactivityMetadata:
      title: ocsfv1.3.0webresourceaccessactivityMetadata
      type: object
      description: >-
        The Metadata object describes the metadata associated with the event.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Metadata/">d3f:Metadata</a>.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        event_code:
          type: string
          nullable: true
          description: The Event ID or Code that the product uses to describe the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            <p>The list of category labels attached to the event or specific
            attributes. Labels are user defined tags or aliases added at
            normalization time.</p>For example: <code>["network",
            "connection.ip:destination", "device.ip:source"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.3.0webresourceaccessactivityMetric:
      title: ocsfv1.3.0webresourceaccessactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo:
      title: ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo
      type: object
      description: >-
        The Network Connection Information object describes characteristics of a
        network connection. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/">d3f:NetworkSession</a>.
      properties:
        boundary:
          type: string
          nullable: true
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'. In the case of 'Other', it is defined by the event
            source. <p> For cloud connections, this translates to the
            traffic-boundary(same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        boundary_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_BoundaryId
          nullable: true
          description: >-
            <p>The normalized identifier of the boundary of the connection.
            </p><p> For cloud connections, this translates to the
            traffic-boundary (same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the initiated connection, traffic, or email,
            normalized to the caption of the direction_id value. In the case of
            'Other', it is defined by the event source.
        direction_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_DirectionId
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The TCP/IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>tcp</code> or <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The TCP/IP protocol number, as defined by the Internet Assigned
            Numbers Authority (IANA). Use -1 if the protocol is not defined by
            IANA. See <a target="_blank"
            href="https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml">Protocol
            Numbers</a>. For example: <code>6</code> for TCP and <code>17</code>
            for UDP.
        protocol_ver:
          type: string
          nullable: true
          description: The Internet Protocol version.
        protocol_ver_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_ProtocolVerId
          nullable: true
          description: The Internet Protocol version identifier.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySession'
          nullable: true
          description: The authenticated user or service session.
        tcp_flags:
          type: integer
          nullable: true
          description: The network connection TCP header flags (i.e., control bits).
        uid:
          type: string
          nullable: true
          description: The unique identifier of the connection.
      required:
        - direction_id
    ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_BoundaryId:
      title: ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_BoundaryId
      type: integer
      description: >-
        NetworkConnectionInfoBoundaryId is an enum, and the following values are
        allowed.

        0 - Unknown: The connection boundary is unknown.

        1 - Localhost: Local network traffic on the same endpoint.

        2 - Internal: Internal network traffic between two endpoints inside
        network.

        3 - External: External network traffic between two endpoints on the
        Internet or outside the network.

        4 - SameVPC: Through another resource in the same VPC

        5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint

        6 - VirtualPrivateGateway: Through a virtual private gateway

        7 - regionVPC: Through an intra-region VPC peering connection

        8 - regionVPC: Through an inter-region VPC peering connection

        9 - LocalGateway: Through a local gateway

        10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances
        only)

        11 - InternetGateway: Through an Internet gateway (Nitro-based instances
        only)

        99 - Other: The boundary is not mapped. See the <code>boundary</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_DirectionId:
      title: ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_DirectionId
      type: integer
      description: >-
        NetworkConnectionInfoDirectionId is an enum, and the following values
        are allowed.

        0 - Unknown: The connection direction is unknown.

        1 - Inbound: Inbound network connection. The connection was originated
        from the Internet or outside network, destined for services on the
        inside network.

        2 - Outbound: Outbound network connection. The connection was originated
        from inside the network, destined for services on the Internet or
        outside network.

        3 - Lateral: Lateral network connection. The connection was originated
        from inside the network, destined for services on the inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_ProtocolVerId:
      title: ocsfv1.3.0webresourceaccessactivityNetworkConnectionInfo_ProtocolVerId
      type: integer
      description: >-
        NetworkConnectionInfoProtocolVerId is an enum, and the following values
        are allowed.

        0 - Unknown: The protocol version is unknown.

        4 - IPv4*

        6 - IPv6*

        99 - Other: The protocol version is not mapped. See the
        <code>protocol_ver</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityNetworkEndpoint:
      title: ocsfv1.3.0webresourceaccessactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityAutonomousSystem
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkEndpoint_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0webresourceaccessactivityNetworkEndpoint_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0webresourceaccessactivityNetworkInterface:
      title: ocsfv1.3.0webresourceaccessactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.3.0webresourceaccessactivityNetworkInterface_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityNetworkProxy:
      title: ocsfv1.3.0webresourceaccessactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:ProxyServer/">d3f:ProxyServer</a>.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityAutonomousSystem
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityNetworkProxy_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.3.0webresourceaccessactivityNetworkProxy_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.3.0webresourceaccessactivityNetworkTraffic:
      title: ocsfv1.3.0webresourceaccessactivityNetworkTraffic
      type: object
      description: >-
        The Network Traffic object describes characteristics of network traffic.
        Network traffic refers to data moving across a network at a given point
        of time. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:NetworkTraffic/">d3f:NetworkTraffic</a>.
      properties:
        bytes:
          type: integer
          nullable: true
          description: The total number of bytes (in and out).
        bytes_in:
          type: integer
          nullable: true
          description: The number of bytes sent from the destination to the source.
        bytes_out:
          type: integer
          nullable: true
          description: The number of bytes sent from the source to the destination.
        chunks:
          type: integer
          nullable: true
          description: The total number of chunks (in and out).
        chunks_in:
          type: integer
          nullable: true
          description: The number of chunks sent from the destination to the source.
        chunks_out:
          type: integer
          nullable: true
          description: The number of chunks sent from the source to the destination.
        packets:
          type: integer
          nullable: true
          description: The total number of packets (in and out).
        packets_in:
          type: integer
          nullable: true
          description: The number of packets sent from the destination to the source.
        packets_out:
          type: integer
          nullable: true
          description: The number of packets sent from the source to the destination.
    ocsfv1.3.0webresourceaccessactivityObject:
      title: ocsfv1.3.0webresourceaccessactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.3.0webresourceaccessactivityObservable:
      title: ocsfv1.3.0webresourceaccessactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityObservable_TypeId
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - name
        - type_id
    ocsfv1.3.0webresourceaccessactivityObservable_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. A domain name in general is an Internet address that can be
        resolved through the Domain Name System (DNS). For example:
        <code>r2-d2.example.com</code>.

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example, <code>192.168.200.24</code> or
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:
        <code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example: <code>john_doe</code>.

        5 - EmailAddress: Email address. For example:
        <code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:
        <code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example: <code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example: <code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example: <code>80</code> or
        <code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. <div>For
        example:<ul><li>192.168.1.0/24</li><li>2001:0db8:85a3:0000::/64</li></ul></div>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Email/">d3f:Email</a>.

        23 - UniformResourceLocator: The Uniform Resource Locator(URL) object
        describes the characteristics of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details. Defined by D3FEND <a target="_blank"
        href="https://next.d3fend.mitre.org/dao/artifact/d3f:File/">d3f:File</a>.

        25 - Process: The Process object describes a running instance of a
        launched program. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:PhysicalLocation/">d3f:PhysicalLocation</a>.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityOrganization:
      title: ocsfv1.3.0webresourceaccessactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the organization. For example, Widget, Inc.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of the organizational unit, within an organization. For
            example, Finance, IT, R&amp;D
        ou_uid:
          type: string
          nullable: true
          description: >-
            The alternate identifier for an entity's unique identifier. For
            example, its Active Directory OU DN or AWS OU ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization. For example, its Active
            Directory or AWS Org ID.
    ocsfv1.3.0webresourceaccessactivityOs:
      title: ocsfv1.3.0webresourceaccessactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/">d3f:OperatingSystem</a>.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code). For the complete list of country codes, see
            <a target="_blank"
            href="https://www.iso.org/obp/ui/#iso:pub:PUB500001:en">ISO 3166-1
            alpha-2 codes</a>.
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.3.0webresourceaccessactivityOs_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.3.0webresourceaccessactivityOsint:
      title: ocsfv1.3.0webresourceaccessactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityAutonomousSystem
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        kill_chain:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityKillChainPhase
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityVulnerability
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.3.0webresourceaccessactivityOsint_ConfidenceId:
      title: ocsfv1.3.0webresourceaccessactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityOsint_Tlp:
      title: ocsfv1.3.0webresourceaccessactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.
    ocsfv1.3.0webresourceaccessactivityOsint_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, etc.
        generated from a file, malware sample, request header, or otherwise.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.3.0webresourceaccessactivityPackage:
      title: ocsfv1.3.0webresourceaccessactivityPackage
      type: object
      description: >-
        The Software Package object describes details about a software package.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:SoftwarePackage/">d3f:SoftwarePackage</a>.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.3.0webresourceaccessactivityPackage_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityPolicy:
      title: ocsfv1.3.0webresourceaccessactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.3.0webresourceaccessactivityProcess:
      title: ocsfv1.3.0webresourceaccessactivityProcess
      type: object
      description: >-
        The Process object describes a running instance of a launched program.
        Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Process/">d3f:Process</a>.
      properties:
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the first process object, to prevent deep
            nesting.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser'
          nullable: true
          description: The user under which this process is running.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.3.0webresourceaccessactivityProcess_IntegrityId:
      title: ocsfv1.3.0webresourceaccessactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityProduct:
      title: ocsfv1.3.0webresourceaccessactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.3.0webresourceaccessactivityRemediation:
      title: ocsfv1.3.0webresourceaccessactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.3.0webresourceaccessactivityReputation:
      title: ocsfv1.3.0webresourceaccessactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.3.0webresourceaccessactivityReputation_ScoreId:
      title: ocsfv1.3.0webresourceaccessactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityRequest:
      title: ocsfv1.3.0webresourceaccessactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.3.0webresourceaccessactivityResponse:
      title: ocsfv1.3.0webresourceaccessactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of communication flags, normalized to the captions of the
            flag_ids values. In the case of 'Other', they are defined by the
            event source.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.3.0webresourceaccessactivitySan:
      title: ocsfv1.3.0webresourceaccessactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.3.0webresourceaccessactivityService:
      title: ocsfv1.3.0webresourceaccessactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.3.0webresourceaccessactivitySession:
      title: ocsfv1.3.0webresourceaccessactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer. Defined by D3FEND <a
        target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Session/">d3f:Session</a>.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.3.0webresourceaccessactivitySubTechnique:
      title: ocsfv1.3.0webresourceaccessactivitySubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.3.0webresourceaccessactivityTactic:
      title: ocsfv1.3.0webresourceaccessactivityTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.3.0webresourceaccessactivityTechnique:
      title: ocsfv1.3.0webresourceaccessactivityTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.3.0webresourceaccessactivityTimespan:
      title: ocsfv1.3.0webresourceaccessactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may may be populated since each member is of integral
        type. In that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityTimespan_TypeId
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.3.0webresourceaccessactivityTimespan_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityTls:
      title: ocsfv1.3.0webresourceaccessactivityTls
      type: object
      description: >-
        The Transport Layer Security (TLS) object describes the negotiated TLS
        protocol used for secure communications over an establish network
        connection.
      properties:
        alert:
          type: integer
          nullable: true
          description: >-
            The integer value of TLS alert if present. The alerts are defined in
            the TLS specification in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc2246">RFC-2246</a>.
        certificate:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        certificate_chain:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Chain of Certificate Serial Numbers field provides a chain of
            Certificate Issuer Serial Numbers leading to the Root Certificate
            Issuer.
        cipher:
          type: string
          nullable: true
          description: The negotiated cipher suite.
        client_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The client cipher suites that were exchanged during the TLS
            handshake negotiation.
        extension_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityTlsExtension
          nullable: true
          description: The list of TLS extensions.
        handshake_dur:
          type: integer
          nullable: true
          description: >-
            The amount of total time for the TLS handshake to complete after the
            TCP connection is established, including client-side delays, in
            milliseconds.
        ja3_hash:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3 string.
        ja3s_hash:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3S string.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        server_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The server cipher suites that were exchanged during the TLS
            handshake negotiation.
        sni:
          type: string
          nullable: true
          description: The Server Name Indication (SNI) extension sent by the client.
        tls_extension_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityTlsExtension
          nullable: true
          description: The list of TLS extensions.
        version:
          type: string
          description: The TLS protocol version.
      required:
        - version
    ocsfv1.3.0webresourceaccessactivityTlsExtension:
      title: ocsfv1.3.0webresourceaccessactivityTlsExtension
      type: object
      description: >-
        The TLS Extension object describes additional attributes that extend the
        base Transport Layer Security (TLS) object.
      properties:
        data:
          nullable: true
          description: >-
            The data contains information specific to the particular extension
            type.
        type:
          type: string
          nullable: true
          description: 'The TLS extension type. For example: <code>Server Name</code>.'
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityTlsExtension_TypeId
          description: >-
            The TLS extension type identifier. See <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc8446#page-35'>The
            Transport Layer Security (TLS) extension page</a>.
      required:
        - type_id
    ocsfv1.3.0webresourceaccessactivityTlsExtension_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityTlsExtension_TypeId
      type: integer
      description: >-
        TlsExtensionTypeId is an enum, and the following values are allowed.

        0 - name: The Server Name Indication extension.

        1 - fragment_length: The Maximum Fragment Length Negotiation extension.

        5 - request: The Certificate Status Request extension.

        10 - groups: The Supported Groups extension.

        13 - algorithms: The Signature Algorithms extension.

        14 - srtp: The Use SRTP data protection extension.

        15 - heartbeat: The Heartbeat extension.

        16 - layer_protocol_negotiation: The Application-Layer Protocol
        Negotiation extension.

        18 - certificate_timestamp: The Signed Certificate Timestamp extension.

        19 - certificate_type: The Client Certificate Type extension.

        20 - certificate_type: The Server Certificate Type extension.

        21 - padding: The Padding extension.

        41 - shared_key: The Pre Shared Key extension.

        42 - data: The Early Data extension.

        43 - versions: The Supported Versions extension.

        44 - cookie: The Cookie extension.

        45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension.

        47 - authorities: The Certificate Authorities extension.

        48 - filters: The OID Filters extension.

        49 - handshake_auth: The Post-Handshake Client Authentication extension.

        50 - algorithms_cert: The Signature Algorithms extension.

        51 - share: The Key Share extension.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityUrl:
      title: ocsfv1.3.0webresourceaccessactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator(URL) object describes the characteristics
        of a URL. Defined in <a target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc1738">RFC 1738</a> and by
        D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:URL/">d3f:URL</a>.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityUrl_CategoryIds
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.3.0webresourceaccessactivityUrl_CategoryIds:
      title: ocsfv1.3.0webresourceaccessactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.3.0webresourceaccessactivityUser:
      title: ocsfv1.3.0webresourceaccessactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal. Defined by D3FEND <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:UserAccount/">d3f:UserAccount</a>.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityUser_MfaStatusId
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityUser_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityUser_UserStatusId
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.3.0webresourceaccessactivityUser_MfaStatusId:
      title: ocsfv1.3.0webresourceaccessactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityUser_RiskLevelId:
      title: ocsfv1.3.0webresourceaccessactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.3.0webresourceaccessactivityUser_TypeId:
      title: ocsfv1.3.0webresourceaccessactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.3.0webresourceaccessactivityUser_UserStatusId:
      title: ocsfv1.3.0webresourceaccessactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.3.0webresourceaccessactivityVulnerability:
      title: ocsfv1.3.0webresourceaccessactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        affected_code:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityAffectedCode
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityAffectedPackage
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCve'
          nullable: true
          description: >-
            The Common Vulnerabilities and Exposures (<a target='_blank'
            href='https://cve.mitre.org/'>CVE</a>).
        cwe:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: List of vulnerabilities that are related to this vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.3.0webresourceaccessactivityWebResource:
      title: ocsfv1.3.0webresourceaccessactivityWebResource
      type: object
      description: >-
        The Web Resource object describes characteristics of a web resource that
        was affected by the activity/event.
      properties:
        data:
          nullable: true
          description: >-
            Details of the web resource, e.g, <code>file</code> details,
            <code>search</code> results or application-defined resource.
        desc:
          type: string
          nullable: true
          description: Description of the web resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        name:
          type: string
          nullable: true
          description: The name of the web resource.
        type:
          type: string
          nullable: true
          description: The web resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the web resource.
        url_string:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityURLString'
          nullable: true
          description: The URL pointing towards the source of the web resource.
    ocsfv1.3.0webresourceaccessactivityWhois:
      title: ocsfv1.3.0webresourceaccessactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityAutonomousSystem
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.3.0webresourceaccessactivityWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The name of the domain.
        domain_contacts:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.3.0webresourceaccessactivityDomainContact
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.3.0webresourceaccessactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.3.0webresourceaccessactivityWhois_DnssecStatusId:
      title: ocsfv1.3.0webresourceaccessactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
      type: string
      description: Email address. For example:<br /><code>john_doe@example.com</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoFileName:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFileName
      type: string
      description: File name. For example:<br /><code>text-file.txt</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoHash:
      title: ocsfv1.4.0cloudresourcesinventoryinfoHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example:<br /> MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoHostname:
      title: ocsfv1.4.0cloudresourcesinventoryinfoHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. It may
        be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>
    ocsfv1.4.0cloudresourcesinventoryinfoIPAddress:
      title: ocsfv1.4.0cloudresourcesinventoryinfoIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoMACAddress:
      title: ocsfv1.4.0cloudresourcesinventoryinfoMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoPort:
      title: ocsfv1.4.0cloudresourcesinventoryinfoPort
      type: integer
      description: >-
        The TCP/UDP port number. For example:<br /><code>80</code>,<br
        /><code>22</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoProcessName:
      title: ocsfv1.4.0cloudresourcesinventoryinfoProcessName
      type: string
      description: Process name. For example:<br /><code>Notepad</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoSubnet:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>
    ocsfv1.4.0cloudresourcesinventoryinfoTimestamp:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example:<br /><code>1618524549901</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoURLString:
      title: ocsfv1.4.0cloudresourcesinventoryinfoURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoUserName:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUserName
      type: string
      description: User name. For example:<br /><code>john_doe</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoActionId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Custom
        Action', 'Challenge'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        3 - Observed: The activity was observed, but neither explicitly allowed
        nor denied. This is common with IDS and EDR controls that report
        additional information on observed behavior such as TTPs. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Logged', 'Alert', 'Detected',
        'Count', etc.

        4 - Modified: The activity was modified, adjusted, or corrected. The
        <code>disposition_id</code> attribute should be set appropriately, for
        example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.

        99 - Other: The action is not mapped. See the <code>action</code>
        attribute which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoActivityId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Log: The discovered information is via a log.

        2 - Collect: The discovered information is via a collection process.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        5 - Discovery: Discovery events report the existence and state of
        devices, files, configurations, processes, registry keys, and other
        objects.
    ocsfv1.4.0cloudresourcesinventoryinfoClassUid:
      title: ocsfv1.4.0cloudresourcesinventoryinfoClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        5023 - CloudResourcesInventoryInfo: Cloud Resources Inventory Info
        events report cloud asset inventory data that is either logged or
        proactively collected. For example, use this event class when creating
        an inventory of cloud resource information from a Configuration
        Management Database (CMDB), Cyber Asset Attack Surface Management
        (CAASM), direct public cloud service provider APIs,
        Software-as-a-Service (SaaS) APIs, or otherwise.
    ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCloudResourcesInventoryInfo
      type: object
      description: >-
        Cloud Resources Inventory Info events report cloud asset inventory data
        that is either logged or proactively collected. For example, use this
        event class when creating an inventory of cloud resource information
        from a Configuration Management Database (CMDB), Cyber Asset Attack
        Surface Management (CAASM), direct public cloud service provider APIs,
        Software-as-a-Service (SaaS) APIs, or otherwise.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. An unknown action may still correspond
            to a known disposition. Refer to <code>disposition_id</code> for the
            outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity. Note that this is not the threat
            actor of a campaign but may be part of a campaign.
        api:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAttack'
          nullable: true
          description: >-
            An array of <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> objects describing identified tactics, techniques
            &amp; sub-techniques.
        authorizations:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAuthorization
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Discovery</code>.
        category_uid:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCategoryUid
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCloud'
          nullable: true
          description: >-
            Cloud service provider or SaaS platform metadata about the cloud
            resource(s) that are being discovered by an inventory process.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        container:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoContainer'
          nullable: true
          description: >-
            A cloud-based container image or running container discovered by an
            inventory process.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: A list of custom fields
        database:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDatabase'
          nullable: true
          description: A cloud-based database discovered by an inventory process.
        databucket:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDatabucket'
          nullable: true
          description: >-
            A cloud-based data bucket or other object storage discovered by an
            inventory process.
        device:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDevice'
          nullable: true
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDispositionId
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEnrichment
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        firewall_rule:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFirewallRule
          nullable: true
          description: >-
            The firewall rule that pertains to the control that triggered the
            event, if applicable.
        idp:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIdp'
          nullable: true
          description: >-
            The Identity Provider that is being discovered by an inventory
            process, or that is related to the cloud resource(s) being
            discovered by an inventory process.
        is_alert:
          type: boolean
          nullable: true
          description: >-
            Indicates that the event is considered to be an alertable signal.
            Should be set to <code>true</code> if <code>disposition_id =
            Alert</code> among other dispositions, and/or
            <code>risk_level_id</code> or <code>severity_id</code> of the event
            is elevated. Not all control events will be alertable, for example
            if <code>disposition_id = Exonerated</code> or <code>disposition_id
            = Allowed</code>.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObservable
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoPolicy'
          nullable: true
          description: >-
            The policy that pertains to the control that triggered the event, if
            applicable. For example the name of an anti-malware policy or an
            access control policy.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        region:
          type: string
          nullable: true
          description: >-
            The cloud region where the resource is located, e.g.,
            <code>us-isof-south-1</code>, <code>eastus2</code>,
            <code>us-central1</code>, etc.
        resources:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoResourceDetails
          nullable: true
          description: >-
            The cloud resource(s) that are being discovered by an inventory
            process. Use this object if there is not a direct object match in
            the class.
        risk_details:
          type: string
          nullable: true
          description: Describes the risk associated with the finding.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            severity_id value. In the case of 'Other', it is defined by the
            source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        table:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTable'
          nullable: true
          description: A cloud-based database table discovered by an inventory process.
        time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDispositionId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoSeverityId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoStatusId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoTypeUid:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        502300 - Unknown

        502301 - Log: The discovered information is via a log.

        502302 - Collect: The discovered information is via a collection
        process.

        502399 - Other
    ocsfv1.4.0cloudresourcesinventoryinfoAccount:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
        Additionally, the Account object refers to logical Cloud and
        Software-as-a-Service (SaaS) based containers such as AWS Accounts,
        Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects,
        and otherwise.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the account.
        name:
          type: string
          nullable: true
          description: >-
            The name of the account (e.g. <code> GCP Project name </code>,
            <code> Linux Account name </code> or <code> AWS Account
            name</code>).
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            account.
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAccount_TypeId
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the account (e.g. <code> AWS Account ID
            </code>, <code> OCID </code>, <code> GCP Project ID </code>, <code>
            Azure Subscription ID </code>, <code> Google Workspace Customer ID
            </code>, or <code> M365 Tenant UID</code>).
    ocsfv1.4.0cloudresourcesinventoryinfoAccount_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        11 - GCPProject
        12 - OCICompartment
        13 - AzureSubscription
        14 - SalesforceAccount
        15 - GoogleWorkspace
        16 - ServicenowInstance
        17 - M365Tenant
        18 - EmailAccount
        99 - Other: The account type is not mapped.
    ocsfv1.4.0cloudresourcesinventoryinfoActor:
      title: ocsfv1.4.0cloudresourcesinventoryinfoActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
        Note that Actor is not the threat actor of a campaign but may be part of
        a campaign.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoActor_ActorTypeId
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAuthorization
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.4.0cloudresourcesinventoryinfoActor_ActorTypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoAdvisory:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAdvisory
      type: object
      description: >-
        The Advisory object represents publicly disclosed cybersecurity
        vulnerabilities defined in a Secruity advisory. e.g. <code> Microsoft KB
        Article, Apple Security Advisory</code>
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The Advisory bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the Advisory.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the Advisory record was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was created.
        desc:
          type: string
          nullable: true
          description: A brief description of the Advisory Record.
        install_state:
          type: string
          nullable: true
          description: The install state of the Advisory.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAdvisory_InstallStateId
          nullable: true
          description: The normalized install state ID of the Advisory.
        is_superseded:
          type: boolean
          nullable: true
          description: The Advisory has been replaced by another.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the Advisory record was last updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was last updated.
        os:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOs'
          nullable: true
          description: The operating system the Advisory applies to.
        product:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerabilities disclosed in the Advisory.
        related_cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCve'
          nullable: true
          description: >-
            A list of Common Vulnerabilities and Exposures <a target="_blank"
            href="https://cve.mitre.org/">(CVE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCwe'
          nullable: true
          description: >-
            A list of Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        size:
          type: integer
          nullable: true
          description: >-
            The size in bytes for the Advisory. Usually populated for a KB
            Article patch.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: The Advisory link from the source vendor.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the Advisory.
        uid:
          type: string
          description: The unique number assigned to the disclosed vulnerability.
      required:
        - uid
    ocsfv1.4.0cloudresourcesinventoryinfoAdvisory_InstallStateId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAdvisory_InstallStateId
      type: integer
      description: >-
        AdvisoryInstallStateId is an enum, and the following values are allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoAffectedCode:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRemediation
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.4.0cloudresourcesinventoryinfoAffectedPackage:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        path:
          type: string
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRemediation
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.4.0cloudresourcesinventoryinfoAffectedPackage_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoAgent:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAgent_TypeId
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoAgent_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoAnalytic:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAnalytic_TypeId
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoAnalytic_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoApi:
      title: ocsfv1.4.0cloudresourcesinventoryinfoApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.4.0cloudresourcesinventoryinfoAttack:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAttack
      type: object
      description: >-
        The <a target="_blank" href="https://attack.mitre.org">MITRE
        ATT&amp;CK®</a> object describes the tactic, technique &amp;
        sub-technique associated to an attack as defined in <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        sub_technique:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSubTechnique
          nullable: true
          description: >-
            The Sub Technique object describes the sub technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactic:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated to an attack, as defined by <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>.
        version:
          type: string
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a> version.
    ocsfv1.4.0cloudresourcesinventoryinfoAuthFactor:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAuthFactor
      type: object
      description: >-
        An Authentication Factor object describes a category of methods used for
        identity verification in an authentication attempt.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDevice'
          nullable: true
          description: Device used to complete an authentication request.
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The email address used in an email-based authentication factor.
        factor_type:
          type: string
          nullable: true
          description: The type of authentication factor used in an authentication attempt.
        factor_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAuthFactor_FactorTypeId
          description: The normalized identifier for the authentication factor.
        is_hotp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is an HMAC-based One-time Password
            (HOTP).
        is_totp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is a Time-based One-time Password
            (TOTP).
        phone_number:
          type: string
          nullable: true
          description: The phone number used for a telephony-based authentication request.
        provider:
          type: string
          nullable: true
          description: The name of provider for an authentication factor.
        security_questions:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The question(s) provided to user for a question-based authentication
            factor.
      required:
        - factor_type_id
    ocsfv1.4.0cloudresourcesinventoryinfoAuthFactor_FactorTypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAuthFactor_FactorTypeId
      type: integer
      description: >-
        AuthFactorFactorTypeId is an enum, and the following values are allowed.

        0 - Unknown

        1 - SMS: User receives and inputs a code sent to their mobile device via
        SMS text message.

        2 - SecurityQuestion: The user responds to a security question as part
        of a question-based authentication factor

        3 - PhoneCall: System calls the user's registered phone number and
        requires the user to answer and provide a response.

        4 - Biometric: Devices that verify identity-based on user's physical
        identifiers, such as fingerprint scanners or retina scanners.

        5 - PushNotification: Push notification is sent to user's registered
        device and requires the user to acknowledge.

        6 - HardwareToken: Physical device that generates a code to be used for
        authentication.

        7 - OTP: Application generates a one-time password (OTP) for use in
        authentication.

        8 - Email: A code or link is sent to a user's registered email address.

        9 - U2F: Typically involves a hardware token, which the user physically
        interacts with to authenticate.

        10 - WebAuthn: Web-based API that enables users to register devices as
        authentication factors.

        11 - Password: The user enters a password that they have previously
        established.

        99 - Other
    ocsfv1.4.0cloudresourcesinventoryinfoAuthorization:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.4.0cloudresourcesinventoryinfoAutonomousSystem:
      title: ocsfv1.4.0cloudresourcesinventoryinfoAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.4.0cloudresourcesinventoryinfoCertificate:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - issuer
        - serial_number
    ocsfv1.4.0cloudresourcesinventoryinfoCloud:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud or
        Software-as-a-Service account or similar construct, such as AWS Account
        ID, regions, organizations, folders, compartments, tenants, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        org:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOrganization
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.4.0cloudresourcesinventoryinfoContainer:
      title: ocsfv1.4.0cloudresourcesinventoryinfoContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoImage'
          nullable: true
          description: The container image used as a template to run the container.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            container.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoCve:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> details related to the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.4.0cloudresourcesinventoryinfoCvss:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The source URL for the CVSS score. For example:
            <code>https://nvd.nist.gov/vuln/detail/CVE-2021-44228</code>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor that provided the CVSS score. For example: <code>NVD,
            REDHAT</code> etc.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.4.0cloudresourcesinventoryinfoCvss_Depth:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.4.0cloudresourcesinventoryinfoCwe:
      title: ocsfv1.4.0cloudresourcesinventoryinfoCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.4.0cloudresourcesinventoryinfoDatabase:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDatabase
      type: object
      description: >-
        The database object is used for databases which are typically datastore
        services that contain an organized collection of structured and
        unstructured data or a types of data.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the database was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the database was known to have been created.
        desc:
          type: string
          nullable: true
          description: The description of the database.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The group names to which the database belongs.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the database.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the database.
        name:
          type: string
          nullable: true
          description: >-
            The database name, ordinarily as assigned by a database
            administrator.
        size:
          type: integer
          nullable: true
          description: The size of the database in bytes.
        type:
          type: string
          nullable: true
          description: The database type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDatabase_TypeId
          description: The normalized identifier of the database type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the database.
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoDatabase_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDatabase_TypeId
      type: integer
      description: >-
        DatabaseTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Relational

        2 - Network

        3 - ObjectOriented

        4 - Centralized

        5 - Operational

        6 - NoSQL

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDatabucket:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDatabucket
      type: object
      description: >-
        The databucket object is a basic container that holds data, typically
        organized through the use of data partitions.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the databucket was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the databucket was known to have been created.
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        desc:
          type: string
          nullable: true
          description: The description of the databucket.
        encryption_details:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails
          nullable: true
          description: >-
            The encryption details of the databucket. Should be populated if the
            databucket is encrypted.
        file:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile'
          nullable: true
          description: Details about the file/object within a databucket.
        group:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The name of the related resource group.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The group names to which the databucket belongs.
        ip:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        is_encrypted:
          type: boolean
          nullable: true
          description: Indicates if the databucket is encrypted.
        is_public:
          type: boolean
          nullable: true
          description: Indicates if the databucket is publicly accessible.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the databucket.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the databucket.
        name:
          type: string
          nullable: true
          description: The databucket name.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        size:
          type: integer
          nullable: true
          description: The size of the databucket in bytes.
        type:
          type: string
          nullable: true
          description: The databucket type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDatabucket_TypeId
          description: The normalized identifier of the databucket type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the databucket.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoDatabucket_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDatabucket_TypeId
      type: integer
      description: >-
        DatabucketTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - S3

        2 - AzureBlob

        3 - GCPBucket

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDevice:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        container:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDeviceHwInfo
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        image:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity that is associated with
            the device.
        imei_list:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity values that are
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        model:
          type: string
          nullable: true
          description: >-
            The model of the device. For example <code>ThinkPad X1
            Carbon</code>.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoNetworkInterface
          nullable: true
          description: >-
            The network interfaces that are associated with the device, one for
            each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOrganization
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOs'
          nullable: true
          description: The endpoint operating system.
        os_machine_uuid:
          type: string
          nullable: true
          description: >-
            The operating system assigned Machine ID. In Windows, this is the
            value stored at the registry path:
            <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid</code>.
            In Linux, this is stored in the file: <code>/etc/machine-id</code>.
        owner:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDevice_TypeId
          description: The device type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOrganization
          nullable: true
          description: The product vendor that created the device.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor for the device. For example <code>Dell</code> or
            <code>Lenovo</code>.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoDevice_NetworkStatusId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.4.0cloudresourcesinventoryinfoDevice_RiskLevelId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoDevice_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)"> Load
        Balancer device.

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.</a>
    ocsfv1.4.0cloudresourcesinventoryinfoDeviceHwInfo:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_architecture:
          type: string
          nullable: true
          description: >-
            The CPU architecture, normalized to the caption of the
            <code>cpu_architecture_id</code> value. In the case of
            <code>Other</code>, it is defined by the source.
        cpu_architecture_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDeviceHwInfo_CpuArchitectureId
          nullable: true
          description: The normalized identifier of the CPU architecture.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyboardInfo
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
        uuid:
          type: string
          nullable: true
          description: >-
            The device manufacturer assigned universally unique hardware
            identifier. For example: The BIOS System UUID or the Apple
            IOPlatformUUID.
        vendor_name:
          type: string
          nullable: true
          description: The device manufacturer.
    ocsfv1.4.0cloudresourcesinventoryinfoDeviceHwInfo_CpuArchitectureId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDeviceHwInfo_CpuArchitectureId
      type: integer
      description: >-
        DeviceHwInfoCpuArchitectureId is an enum, and the following values are
        allowed.

        0 - Unknown: The CPU architecture is unknown.

        1 - x86: CPU uses the x86 ISA. For bitness, refer to
        <code>cpu_bits</code>.

        2 - ARM: CPU uses the ARM ISA. For bitness, refer to
        <code>cpu_bits</code>.

        3 - V: CPU uses the RISC-V ISA. For bitness, refer to
        <code>cpu_bits</code>.

        99 - Other: The CPU architecture is not mapped. See the
        <code>cpu_architecture</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCertificate
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature_AlgorithmId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature_StateId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDisplay:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.4.0cloudresourcesinventoryinfoDnsAnswer:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.4.0cloudresourcesinventoryinfoDnsAnswer_FlagIds:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoDomainContact:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoDomainContact_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoEmail:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction, and can include embedded URLs and files.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: >-
            The machine-readable email header Cc values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>.
        cc_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Cc Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        delivered_to:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            field. For example <code>example.user@usersdomain.com</code>
        delivered_to_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            values. For example <code>example.user@usersdomain.com</code>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile'
          nullable: true
          description: The files embedded or attached to the email.
        from:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: >-
            The machine-readable email header From values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        from_mailbox:
          type: string
          nullable: true
          description: >-
            The human-readable email header From Mailbox value. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        http_headers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoHttpHeader
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-ID value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: >-
            The machine-readable email header Reply-To values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Reply To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: >-
            The machine-readable email header To values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>
        to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the email thread.
        urls:
          type: array
          items:
            type: string
          nullable: true
          description: The URLs embedded in the email.
        x_originating_ip:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIPAddress
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
    ocsfv1.4.0cloudresourcesinventoryinfoEmailAuth:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails
      type: object
      description: Details about the encrytpion methodology utilized.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The encryption algorithm used, normalized to the caption of
            'algorithm_id
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails_AlgorithmId
          nullable: true
          description: The encryption algorithm used.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key used.
        key_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the key used for encrpytion. For example,
            AWS KMS Key ARN.
        type:
          type: string
          nullable: true
          description: The type of the encryption used.
    ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails_AlgorithmId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails_AlgorithmId
      type: integer
      description: >-
        EncryptionDetailsAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DES: Data Encryption Standard Algorithm

        2 - TripleDES: Triple Data Encryption Standard Algorithm

        3 - AES: Advanced Encryption Standard Algorithm.

        4 - RSA: Rivest-Shamir-Adleman Algorithm

        5 - ECC: Elliptic Curve Cryptography Algorithm

        6 - SM2: ShangMi Cryptographic Algorithm

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoEnrichment:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoEnvironmentVariable:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEnvironmentVariable
      type: object
      description: An environment variable.
      properties:
        name:
          type: string
          description: The name of the environment variable.
        value:
          type: string
          description: The value of the environment variable.
      required:
        - name
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoEpss:
      title: ocsfv1.4.0cloudresourcesinventoryinfoEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.4.0cloudresourcesinventoryinfoExtension:
      title: ocsfv1.4.0cloudresourcesinventoryinfoExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.4.0cloudresourcesinventoryinfoFeature:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.4.0cloudresourcesinventoryinfoFile:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        drive_type:
          type: string
          nullable: true
          description: >-
            The drive type, normalized to the caption of the
            <code>drive_type_id</code> value. In the case of <code>Other</code>,
            it is defined by the source.
        drive_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile_DriveTypeId
          nullable: true
          description: Identifies the type of a disk drive, i.e. fixed, removable, etc.
        encryption_details:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEncryptionDetails
          nullable: true
          description: >-
            The encryption details of the file. Should be populated if the file
            is encrypted.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: An array of hash attributes.
        internal_name:
          type: string
          nullable: true
          description: >-
            The name of the file as identified within the file itself. This
            contrasts with the name by which the file is known on disk. Where
            available, the internal name is widely used by security
            practitioners and detection content because the on-disk file name is
            not reliable. On the Windows OS, most PE files contain a <a
            href="https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource">VERSIONINFO</a>
            resource from which the internal name can be obtained. On macOS,
            binaries can optionally embed a copy of the application's Info.plist
            file which in turn contains the name of the executable.
        is_deleted:
          type: boolean
          nullable: true
          description: Indicates if the file was deleted from the filesystem.
        is_encrypted:
          type: boolean
          nullable: true
          description: Indicates if the file is encrypted.
        is_public:
          type: boolean
          nullable: true
          description: >-
            Indicates if the file is publicly accessible. For example in an
            object's public access in AWS S3
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          type: string
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        storage_class:
          type: string
          nullable: true
          description: >-
            The storage class of the file. For example in AWS S3:
            <code>STANDARD, STANDARD_IA, GLACIER</code>.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            file.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile_TypeId
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUrl'
          nullable: true
          description: The URL of the file, when applicable.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        xattributes:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoFile_ConfidentialityId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoFile_DriveTypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFile_DriveTypeId
      type: integer
      description: >-
        FileDriveTypeId is an enum, and the following values are allowed.

        0 - Unknown: The drive type is unknown.

        1 - Removable: The drive has removable media; for example, a floppy
        drive, thumb drive, or flash card reader.

        2 - Fixed: The drive has fixed media; for example, a hard disk drive or
        flash drive.

        3 - Remote: The drive is a remote (network) drive.

        4 - ROM: The drive is a CD-ROM drive.

        5 - RAMDisk: The drive is a RAM disk.

        99 - Other: The drive type is not mapped. See the
        <code>drive_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoFile_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoFingerprint:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of <code>algorithm_id</code>. In the case
            of <code>Other</code>, it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoFingerprint_AlgorithmId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoFirewallRule:
      title: ocsfv1.4.0cloudresourcesinventoryinfoFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.4.0cloudresourcesinventoryinfoGroup:
      title: ocsfv1.4.0cloudresourcesinventoryinfoGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization, including but not
        limited to purposes of access control.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.4.0cloudresourcesinventoryinfoHttpHeader:
      title: ocsfv1.4.0cloudresourcesinventoryinfoHttpHeader
      type: object
      description: >-
        The HTTP Header object represents the headers sent in an HTTP request or
        response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the HTTP header.
        value:
          type: string
          description: The value of the HTTP header.
      required:
        - name
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoIdp:
      title: ocsfv1.4.0cloudresourcesinventoryinfoIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        auth_factors:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAuthFactor
          nullable: true
          description: >-
            The Authentication Factors object describes the different types of
            Multi-Factor Authentication (MFA) methods and/or devices supported
            by the Identity Provider.
        domain:
          type: string
          nullable: true
          description: The primary domain associated with the Identity Provider.
        fingerprint:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: >-
            The fingerprint of the X.509 certificate used by the Identity
            Provider.
        has_mfa:
          type: boolean
          nullable: true
          description: The Identity Provider enforces Multi Factor Authentication (MFA).
        issuer:
          type: string
          nullable: true
          description: >-
            The unique identifier (often a URL) used by the Identity Provider as
            its issuer.
        name:
          type: string
          nullable: true
          description: The name of the Identity Provider.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol of the Identity Provider. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        scim:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoScim'
          nullable: true
          description: >-
            The System for Cross-domain Identity Management (SCIM) resource
            object provides a structured set of attributes related to SCIM
            protocols used for identity provisioning and management across
            cloud-based platforms. It standardizes user and group provisioning
            details, enabling identity synchronization and lifecycle management
            with compatible Identity Providers (IdPs) and applications. SCIM is
            defined in <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc7643'>RFC-7634</a>
        sso:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSso'
          nullable: true
          description: >-
            The Single Sign-On (SSO) object provides a structure for normalizing
            SSO attributes, configuration, and/or settings from Identity
            Providers.
        state:
          type: string
          nullable: true
          description: >-
            The configuration state of the Identity Provider, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIdp_StateId
          nullable: true
          description: >-
            The normalized state ID of the Identity Provider to reflect its
            configuration or activation status.
        tenant_uid:
          type: string
          nullable: true
          description: The tenant ID associated with the Identity Provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the Identity Provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The URL for accessing the configuration or metadata of the Identity
            Provider.
    ocsfv1.4.0cloudresourcesinventoryinfoIdp_StateId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoIdp_StateId
      type: integer
      description: >-
        IdpStateId is an enum, and the following values are allowed.

        0 - Unknown: The configuration state of the Identity Provider is
        unknown.

        1 - Active: The Identity Provider is in an Active state, or otherwise
        enabled.

        2 - Suspended: The Identity Provider is in a Suspended state.

        3 - Deprecated: The Identity Provider is in a Deprecated state, or is
        otherwise disabled.

        4 - Deleted: The Identity Provider is in a Deleted state.

        99 - Other: The configuration state of the Identity Provider is not
        mapped. See the <code>state</code> attribute, which contains a data
        source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoImage:
      title: ocsfv1.4.0cloudresourcesinventoryinfoImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the image.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          type: string
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            image.
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.4.0cloudresourcesinventoryinfoKbArticle:
      title: ocsfv1.4.0cloudresourcesinventoryinfoKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.4.0cloudresourcesinventoryinfoKbArticle_InstallStateId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject:
      title: ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
      type: object
      description: A generic object allowing to define a <code>{key:value}</code> pair.
      properties:
        name:
          type: string
          description: The name of the key.
        value:
          type: string
          nullable: true
          description: The value associated to the key.
        values:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Optional, the values associated to the key. You can populate this
            attribute, when you have multiple values for the same key.
      required:
        - name
    ocsfv1.4.0cloudresourcesinventoryinfoKeyboardInfo:
      title: ocsfv1.4.0cloudresourcesinventoryinfoKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.4.0cloudresourcesinventoryinfoKillChainPhase:
      title: ocsfv1.4.0cloudresourcesinventoryinfoKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.4.0cloudresourcesinventoryinfoKillChainPhase_PhaseId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoLdapPerson:
      title: ocsfv1.4.0cloudresourcesinventoryinfoLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        phone_number:
          type: string
          nullable: true
          description: >-
            The telephone number of the user. Corresponds to the LDAP
            <code>Telephone-Number</code> CN.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            user.
    ocsfv1.4.0cloudresourcesinventoryinfoLdapPerson_EmploymentStatusId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoLocation:
      title: ocsfv1.4.0cloudresourcesinventoryinfoLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address.
      properties:
        aerial_height:
          type: string
          nullable: true
          description: >-
            Expressed as either height above takeoff location or height above
            ground level (AGL) for a UAS current location. This value is
            provided in meters and must have a minimum resolution of 1 m.
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code.<p><b>Note:</b> The two letter
            country code should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geodetic_altitude:
          type: string
          nullable: true
          description: >-
            The aircraft distance above or below the ellipsoid as measured along
            a line that passes through the aircraft and is normal to the surface
            of the WGS-84 ellipsoid. This value is provided in meters and must
            have a minimum resolution of 1 m. Special Values:
            <code>Invalid</code>, <code>No Value</code>, or <code>Unknown: -1000
            m</code>.
        geodetic_vertical_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on geodetic altitude. This is based on
            ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        horizontal_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on horizontal position. This is based
            on ADS-B NACp. Measured in meters.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        pressure_altitude:
          type: string
          nullable: true
          description: >-
            The uncorrected barometric pressure altitude (based on reference
            standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms
            that utilize 'altitude deltas' between aircraft. This value is
            provided in meters and must have a minimum resolution of 1 m..
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. For example, 'CH-VD' for
            the Canton of Vaud, Switzerland
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.4.0cloudresourcesinventoryinfoLogger:
      title: ocsfv1.4.0cloudresourcesinventoryinfoLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDevice'
          nullable: true
          description: The device where the events are logged.
        event_uid:
          type: string
          nullable: true
          description: The unique identifier of the event assigned by the logger.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.4.0cloudresourcesinventoryinfoLongString:
      title: ocsfv1.4.0cloudresourcesinventoryinfoLongString
      type: object
      description: >-
        This object is a used to capture strings which may be truncated by a
        security product due to their length.
      properties:
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates that <code>value</code> has been truncated. May be omitted
            if truncation has not occurred.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The size in bytes of the string represented by <code>value</code>
            before truncation. Should be omitted if truncation has not occurred.
        value:
          type: string
          description: >-
            The string value, truncated if <code>is_truncated</code> is
            <code>true</code>.
      required:
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoMalware:
      title: ocsfv1.4.0cloudresourcesinventoryinfoMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMalware_ClassificationIds
          description: >-
            The list of normalized identifiers of the malware classifications.
            Reference: <a target="_blank"
            href="https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html#_oxlc4df65spl">STIX
            Malware Types</a>
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCve'
          nullable: true
          description: >-
            List of Common Vulnerabilities and Exposures (<a target="_blank"
            href="https://cve.mitre.org/">CVE</a>).
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        path:
          type: string
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: The provider of the malware information.
        uid:
          type: string
          nullable: true
          description: >-
            The malware unique identifier, as reported by the detection engine.
            For example a virus id or an IPS signature id.
      required:
        - classification_ids
    ocsfv1.4.0cloudresourcesinventoryinfoMalware_ClassificationIds:
      title: ocsfv1.4.0cloudresourcesinventoryinfoMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoMetadata:
      title: ocsfv1.4.0cloudresourcesinventoryinfoMetadata
      type: object
      description: The Metadata object describes the metadata associated with the event.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        debug:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Debug information about non-fatal issues with this OCSF event. Each
            issue is a line in this string array.
        event_code:
          type: string
          nullable: true
          description: >-
            The <code>Event ID, Code, or Name</code> that the product uses to
            primarily identify the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoExtension
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of labels attached to the event. For example:
            <code>["sample", "dev"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            event.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.4.0cloudresourcesinventoryinfoMetric:
      title: ocsfv1.4.0cloudresourcesinventoryinfoMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoNetworkInterface:
      title: ocsfv1.4.0cloudresourcesinventoryinfoNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoNetworkInterface_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoObject:
      title: ocsfv1.4.0cloudresourcesinventoryinfoObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.4.0cloudresourcesinventoryinfoObservable:
      title: ocsfv1.4.0cloudresourcesinventoryinfoObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the OCSF event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObservable_TypeId
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoObservable_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. It may be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example:<br /><code>john_doe</code>.

        5 - EmailAddress: Email address. For example:<br
        /><code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example:<br /><code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example:<br />
        MD5: <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example:<br /><code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example:<br
        /><code>80</code>,<br /><code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction, and can include embedded URLs and
        files.

        23 - UniformResourceLocator: The Uniform Resource Locator (URL) object
        describes the characteristics of a URL.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details.

        25 - Process: The Process object describes a running instance of a
        launched program.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoOrganization:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any. Additionally, it also describes cloud
        and Software-as-a-Service (SaaS) logical hierarchies such as AWS
        Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and
        similar constructs.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the organization, Oracle Cloud Tenancy, Google Cloud
            Organization, or AWS Organization. For example, <code> Widget, Inc.
            </code> or the <code> AWS Organization name </code>.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of an organizational unit, Google Cloud Folder, or AWS Org
            Unit. For example, the <code> GCP Project Name </code>, or <code>
            Dev_Prod_OU </code>.
        ou_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of an organizational unit, Google Cloud
            Folder, or AWS Org Unit. For example, an <code> Oracle Cloud Tenancy
            ID </code>, <code> AWS OU ID </code>, or <code> GCP Folder ID
            </code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization, Oracle Cloud Tenancy,
            Google Cloud Organization, or AWS Organization. For example, an
            <code> AWS Org ID </code> or <code> Oracle Cloud Domain ID </code>.
    ocsfv1.4.0cloudresourcesinventoryinfoOs:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code).<p><b>Note:</b> The two letter country code
            should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        kernel_release:
          type: string
          nullable: true
          description: >-
            The kernel release of the operating system. On Unix-based systems,
            this is determined from the <code>uname -r</code> command output,
            for example "5.15.0-122-generic".
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoOs_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.4.0cloudresourcesinventoryinfoOsint:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDnsAnswer
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAutonomousSystem
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        email:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        file:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile'
          nullable: true
          description: >-
            Any pertinent file information related to an indicator or OSINT
            analysis.
        kill_chain:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKillChainPhase
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        location:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        name:
          type: string
          nullable: true
          description: The name of the entity.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAnalytic'
          nullable: true
          description: Any analytics related to an indicator or OSINT analysis.
        reputation:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoReputation'
          nullable: true
          description: >-
            Related reputational analysis from third-party engines and analysts
            for a given indicator or OSINT analysis.
        script:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoScript'
          nullable: true
          description: >-
            Any pertinent script information related to an indicator or OSINT
            analysis.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        subnet:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSubnet'
          nullable: true
          description: A CIDR or network block related to an indicator or OSINT analysis.
        tlp:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOsint_TypeId
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the entity.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoVulnerability
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.4.0cloudresourcesinventoryinfoOsint_ConfidenceId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoOsint_Tlp:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.

        WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably,
        TLP:WHITE is the most up to date (as of TLP 2.0) usage.
    ocsfv1.4.0cloudresourcesinventoryinfoOsint_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP,
        VHASH, etc. generated from a file, malware sample, request header, or
        otherwise used to identify a pertinent artifact.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        11 - File: A file or metadata about a file.

        12 - RegistryKey: A Windows Registry Key.

        13 - RegistryValue: A Windows Registry Value.

        14 - CommandLine: A partial or full Command Line used to invoke scripts
        or other remote commands.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.4.0cloudresourcesinventoryinfoPackage:
      title: ocsfv1.4.0cloudresourcesinventoryinfoPackage
      type: object
      description: The Software Package object describes details about a software package.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        name:
          type: string
          description: The software package name.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            type_id value. In the case of 'Other', it is defined by the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoPackage_TypeId
          nullable: true
          description: The type of software package.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.4.0cloudresourcesinventoryinfoPackage_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoPolicy:
      title: ocsfv1.4.0cloudresourcesinventoryinfoPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.4.0cloudresourcesinventoryinfoProcess:
      title: ocsfv1.4.0cloudresourcesinventoryinfoProcess
      type: object
      description: The Process object describes a running instance of a launched program.
      properties:
        ancestry:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProcessEntity
          nullable: true
          description: >-
            An array of Process Entities describing the extended parentage of
            this process object. Direct parent information sould be expressed
            through the <code>parent_process</code> attribute. The first array
            element is the direct parent of this process object. Subsequent list
            elements go up the process parentage hierarchy. That is, the array
            is sorted from newest to oldest process. It is recommended to only
            populate this field for the top-level process object.
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        environment_variables:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEnvironmentVariable
          nullable: true
          description: Environment variables associated with the process.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProcessName
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the top-level process object, to prevent
            deep nesting. Additional ancestry information can be supplied in the
            <code>ancestry</code> attribute.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The user under which this process is running.
        working_directory:
          type: string
          nullable: true
          description: The working directory of a process.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.4.0cloudresourcesinventoryinfoProcess_IntegrityId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoProcessEntity:
      title: ocsfv1.4.0cloudresourcesinventoryinfoProcessEntity
      type: object
      description: >-
        The Process Entity object provides critical fields for referencing a
        process.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        name:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoProcessName
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
    ocsfv1.4.0cloudresourcesinventoryinfoProduct:
      title: ocsfv1.4.0cloudresourcesinventoryinfoProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.4.0cloudresourcesinventoryinfoRemediation:
      title: ocsfv1.4.0cloudresourcesinventoryinfoRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKbArticle
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.4.0cloudresourcesinventoryinfoReputation:
      title: ocsfv1.4.0cloudresourcesinventoryinfoReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.4.0cloudresourcesinventoryinfoReputation_ScoreId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoRequest:
      title: ocsfv1.4.0cloudresourcesinventoryinfoRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoContainer
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api request.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.4.0cloudresourcesinventoryinfoResourceDetails:
      title: ocsfv1.4.0cloudresourcesinventoryinfoResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAgent'
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoIPAddress'
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoMACAddress'
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.4.0cloudresourcesinventoryinfoResponse:
      title: ocsfv1.4.0cloudresourcesinventoryinfoResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoContainer
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api response.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.4.0cloudresourcesinventoryinfoSan:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.4.0cloudresourcesinventoryinfoScim:
      title: ocsfv1.4.0cloudresourcesinventoryinfoScim
      type: object
      description: >-
        The System for Cross-domain Identity Management (SCIM) Configuration
        object provides a structured set of attributes related to SCIM protocols
        used for identity provisioning and management across cloud-based
        platforms. It standardizes user and group provisioning details, enabling
        identity synchronization and lifecycle management with compatible
        Identity Providers (IdPs) and applications. SCIM is defined in <a
        target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoScim_AuthProtocolId
          nullable: true
          description: >-
            The normalized identifier of the authorization protocol used by the
            SCIM resource.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: When the SCIM resource was added to the service provider.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SCIM resource was added to the service provider.
        error_message:
          type: string
          nullable: true
          description: Message or code associated with the last encountered error.
        is_group_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            groups, automatically or otherwise.
        is_user_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            users, automatically or otherwise.
        last_run_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        name:
          type: string
          nullable: true
          description: The name of the SCIM resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SCIM resource. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        rate_limit:
          type: integer
          nullable: true
          description: >-
            Maximum number of requests allowed by the SCIM resource within a
            specified time frame to avoid throttling.
        scim_group_schema:
          nullable: true
          description: >-
            SCIM provides a schema for representing groups, identified using the
            following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:Group</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            This attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource.
        scim_user_schema:
          nullable: true
          description: >-
            SCIM provides a resource type for user resources. The core schema
            for user is identified using the following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:User</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            his attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource. This object is inclusive of both the
            basic and Enterprise User Schema Extension.
        state:
          type: string
          nullable: true
          description: >-
            The provisioning state of the SCIM resource, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoScim_StateId
          nullable: true
          description: >-
            The normalized state ID of the SCIM resource to reflect its
            activation status.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for a SCIM resource as defined by the service
            provider.
        uid_alt:
          type: string
          nullable: true
          description: >-
            A String that is an identifier for the resource as defined by the
            provisioning client. The <code>externalId</code> may simplify
            identification of a resource between the provisioning client and the
            service provider by allowing the client to use a filter to locate
            the resource with an identifier from the provisioning domain,
            obviating the need to store a local mapping between the provisioning
            domain's identifier of the resource and the identifier used by the
            service provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: The primary URL for SCIM API requests.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SCIM. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
        version:
          type: string
          nullable: true
          description: SCIM protocol version supported e.g., <code>SCIM 2.0</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoScim_AuthProtocolId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoScim_AuthProtocolId
      type: integer
      description: >-
        ScimAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoScim_StateId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoScim_StateId
      type: integer
      description: >-
        ScimStateId is an enum, and the following values are allowed.

        0 - Unknown: The provisioning state of the SCIM resource is unknown.

        1 - Pending: The SCIM resource is Pending activation or creation.

        2 - Active: The SCIM resource is in an Active state, or otherwise
        enabled.

        3 - Failed: The SCIM resource is in a Failed state.

        4 - Deleted: The SCIM resource is in a Deleted state, or otherwise
        disabled.

        99 - Other: The provisioning state of the SCIM resource is not mapped.
        See the <code>state</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoScript:
      title: ocsfv1.4.0cloudresourcesinventoryinfoScript
      type: object
      description: >-
        The Script object describes a script or command that can be executed by
        a shell, script engine, or interpreter. Examples include Bash,
        JavsScript, PowerShell, Python, VBScript, etc. Note that the term
        <em>script</em> here denotes not only a script contained within a file
        but also a script or command typed interactively by a user, supplied on
        the command line, or provided by some other file-less mechanism.
      properties:
        file:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFile'
          nullable: true
          description: >-
            Present if this script is associated with a file. Not present in the
            case of a file-less script.
        hashes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoFingerprint
          nullable: true
          description: >-
            An array of the script's cryptographic hashes. Note that these
            hashes are calculated on the script in its original encoding, and
            not on the normalized UTF-8 encoding found in the
            <code>script_content</code> attribute.
        name:
          type: string
          nullable: true
          description: >-
            Unique identifier for the script or macro, independent of the
            containing file, used for tracking, auditing, and security analysis.
        parent_uid:
          type: string
          nullable: true
          description: >-
            This attribute relates a sub-script to a parent script having the
            matching <code>uid</code> attribute. In the case of PowerShell,
            sub-script execution can be identified by matching the activity
            correlation ID of the raw ETW events provided by the OS.
        script_content:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLongString'
          description: >-
            The script content, normalized to UTF-8 encoding irrespective of its
            original encoding. When emitting this attribute, it may be
            appropriate to truncate large scripts. When consuming this
            attribute, large scripts should be anticipated.
        type:
          type: string
          nullable: true
          description: >-
            The script type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the event source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoScript_TypeId
          description: The normalized script type ID.
        uid:
          type: string
          nullable: true
          description: >-
            Some script engines assign a unique ID to each individual execution
            of a given script. This attribute captures that unique ID. In the
            case of PowerShell, the unique ID corresponds to the
            <code>ScriptBlockId</code> in the raw ETW events provided by the OS.
      required:
        - script_content
        - type_id
    ocsfv1.4.0cloudresourcesinventoryinfoScript_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoScript_TypeId
      type: integer
      description: >-
        ScriptTypeId is an enum, and the following values are allowed.

        0 - Unknown: The script type is unknown.

        1 - WindowsCommandPrompt

        2 - PowerShell

        3 - Python

        4 - JavaScript

        5 - VBScript

        6 - UnixShell

        7 - VBA

        99 - Other: The script type is not mapped. See the <code>type</code>
        attribute which contains an event source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoService:
      title: ocsfv1.4.0cloudresourcesinventoryinfoService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.4.0cloudresourcesinventoryinfoSession:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.4.0cloudresourcesinventoryinfoSso:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSso
      type: object
      description: >-
        The Single Sign-On (SSO) object provides a structure for normalizing SSO
        attributes, configuration, and/or settings from Identity Providers.
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSso_AuthProtocolId
          nullable: true
          description: >-
            The normalized identifier of the authentication protocol used by the
            SSO resource.
        certificate:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCertificate
          nullable: true
          description: >-
            Digital Signature associated with the SSO resource, e.g., SAML X.509
            certificate details.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: When the SSO resource was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SSO resource was created.
        duration_mins:
          type: integer
          nullable: true
          description: >-
            The duration (in minutes) for an SSO session, after which
            re-authentication is required.
        idle_timeout:
          type: integer
          nullable: true
          description: >-
            Duration (in minutes) of allowed inactivity before Single Sign-On
            (SSO) session expiration.
        login_endpoint:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: URL for initiating an SSO login request.
        logout_endpoint:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            URL for initiating an SSO logout request, allowing sessions to be
            terminated across applications.
        metadata_endpoint:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            URL where metadata about the SSO configuration is available (e.g.,
            for SAML configurations).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The most recent time when the SSO resource was updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent time when the SSO resource was updated.
        name:
          type: string
          nullable: true
          description: The name of the SSO resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SSO resource. E.g., <code>SAML</code>
            or <code>OIDC</code>.
        scopes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Scopes define the specific permissions or actions that the client is
            allowed to perform on behalf of the user. Each scope represents a
            different set of permissions, and the user can selectively grant or
            deny access to specific scopes during the authorization process.
        uid:
          type: string
          nullable: true
          description: A unique identifier for a SSO resource.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SSO. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoSso_AuthProtocolId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSso_AuthProtocolId
      type: integer
      description: >-
        SsoAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoSubTechnique:
      title: ocsfv1.4.0cloudresourcesinventoryinfoSubTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Sub Technique object describes the sub technique
        ID and/or name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Scanning IP Blocks</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub technique, as defined by
            <a target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595.001</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoTable:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTable
      type: object
      description: >-
        The table object represents a table within a structured relational
        database or datastore, which contains columns and rows of data that are
        able to be create, updated, deleted and queried.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the table was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the table was known to have been created.
        desc:
          type: string
          nullable: true
          description: The description of the table.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The group names to which the table belongs.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the table.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when any changes, updates, or modifications
            were made within the table.
        name:
          type: string
          nullable: true
          description: The table name, ordinarily as assigned by a database administrator.
        size:
          type: integer
          nullable: true
          description: The size of the data table in bytes.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the table.
    ocsfv1.4.0cloudresourcesinventoryinfoTactic:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTactic
      type: object
      description: >-
        The MITRE ATT&amp;CK® Tactic object describes the tactic ID and/or name
        that is associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Reconnaissance</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack tactic, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The tactic ID that is associated with the attack technique, as
            defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>TA0043</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoTechnique:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTechnique
      type: object
      description: >-
        The MITRE ATT&amp;CK® Technique object describes the technique ID and/or
        name associated to an attack, as defined by <a target="_blank"
        href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
        Matrix</a>.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique, as defined by <a target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>Active Scanning</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique, as defined by <a
            target='_blank'
            href='https://attack.mitre.org/wiki/ATT&CK_Matrix'>ATT&CK®
            Matrix</a>. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>. For example: <code>T1595</code>.
    ocsfv1.4.0cloudresourcesinventoryinfoTimespan:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may be populated since each member is of integral type. In
        that case <code>type_id</code> if present should be set to
        <code>Other</code>.
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimespan_TypeId
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.4.0cloudresourcesinventoryinfoTimespan_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoUrl:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUrl
      type: object
      description: >-
        The Uniform Resource Locator (URL) object describes the characteristics
        of a URL.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUrl_CategoryIds
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.4.0cloudresourcesinventoryinfoUrl_CategoryIds:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.4.0cloudresourcesinventoryinfoUser:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The user's primary email address.
        forward_addr:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The user's forwarding email address.
        full_name:
          type: string
          nullable: true
          description: >-
            The full name of the person, as per the LDAP Common Name attribute
            (cn).
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser_MfaStatusId
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoOrganization
          nullable: true
          description: Organization and org unit related to the user.
        phone_number:
          type: string
          nullable: true
          description: The telephone number of the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser_TypeId
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoUser_UserStatusId
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.4.0cloudresourcesinventoryinfoUser_MfaStatusId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoUser_RiskLevelId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.4.0cloudresourcesinventoryinfoUser_TypeId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoUser_UserStatusId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.4.0cloudresourcesinventoryinfoVulnerability:
      title: ocsfv1.4.0cloudresourcesinventoryinfoVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        advisory:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAdvisory'
          nullable: true
          description: >-
            Detail about the security advisory, that is used to publicly
            disclose cybersecurity vulnerabilities by a vendor.
        affected_code:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAffectedCode
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAffectedPackage
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        cve:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCve'
          nullable: true
          description: >-
            Describes the Common Vulnerabilities and Exposures <a
            target='_blank' href='https://cve.mitre.org/'>(CVE)</a> details
            related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target='_blank'
            href='https://cwe.mitre.org/'>(CWE)</a> details related to the
            vulnerability.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        exploit_last_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the exploit was most recently observed.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoKbArticle
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            List of vulnerability IDs (e.g. CVE ID) that are related to this
            vulnerability.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoRemediation
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.4.0cloudresourcesinventoryinfoWhois:
      title: ocsfv1.4.0cloudresourcesinventoryinfoWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoAutonomousSystem
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The domain name corresponding to the WHOIS record.
        domain_contacts:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoDomainContact
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoEmailAddress
          nullable: true
          description: The email address for the registrar's abuse contact
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.4.0cloudresourcesinventoryinfoSubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.4.0cloudresourcesinventoryinfoWhois_DnssecStatusId:
      title: ocsfv1.4.0cloudresourcesinventoryinfoWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingEmailAddress:
      title: ocsfv1.5.0applicationsecurityposturefindingEmailAddress
      type: string
      description: Email address. For example:<br /><code>john_doe@example.com</code>.
    ocsfv1.5.0applicationsecurityposturefindingFileName:
      title: ocsfv1.5.0applicationsecurityposturefindingFileName
      type: string
      description: File name. For example:<br /><code>text-file.txt</code>.
    ocsfv1.5.0applicationsecurityposturefindingFilePath:
      title: ocsfv1.5.0applicationsecurityposturefindingFilePath
      type: string
      description: >-
        The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.
    ocsfv1.5.0applicationsecurityposturefindingHash:
      title: ocsfv1.5.0applicationsecurityposturefindingHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example:<br /> MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.5.0applicationsecurityposturefindingHostname:
      title: ocsfv1.5.0applicationsecurityposturefindingHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. It may
        be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>
    ocsfv1.5.0applicationsecurityposturefindingIPAddress:
      title: ocsfv1.5.0applicationsecurityposturefindingIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.5.0applicationsecurityposturefindingMACAddress:
      title: ocsfv1.5.0applicationsecurityposturefindingMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.
    ocsfv1.5.0applicationsecurityposturefindingPort:
      title: ocsfv1.5.0applicationsecurityposturefindingPort
      type: integer
      description: >-
        The TCP/UDP port number. For example:<br /><code>80</code>,<br
        /><code>22</code>.
    ocsfv1.5.0applicationsecurityposturefindingProcessName:
      title: ocsfv1.5.0applicationsecurityposturefindingProcessName
      type: string
      description: Process name. For example:<br /><code>Notepad</code>.
    ocsfv1.5.0applicationsecurityposturefindingSubnet:
      title: ocsfv1.5.0applicationsecurityposturefindingSubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>
    ocsfv1.5.0applicationsecurityposturefindingTimestamp:
      title: ocsfv1.5.0applicationsecurityposturefindingTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example:<br /><code>1618524549901</code>.
    ocsfv1.5.0applicationsecurityposturefindingURLString:
      title: ocsfv1.5.0applicationsecurityposturefindingURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.5.0applicationsecurityposturefindingUserName:
      title: ocsfv1.5.0applicationsecurityposturefindingUserName
      type: string
      description: User name. For example:<br /><code>john_doe</code>.
    ocsfv1.5.0applicationsecurityposturefindingActionId:
      title: ocsfv1.5.0applicationsecurityposturefindingActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Custom
        Action', 'Challenge'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        3 - Observed: The activity was observed, but neither explicitly allowed
        nor denied. This is common with IDS and EDR controls that report
        additional information on observed behavior such as TTPs. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Logged', 'Alert', 'Detected',
        'Count', etc.

        4 - Modified: The activity was modified, adjusted, or corrected. The
        <code>disposition_id</code> attribute should be set appropriately, for
        example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.

        99 - Other: The action is not mapped. See the <code>action</code>
        attribute which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingActivityId:
      title: ocsfv1.5.0applicationsecurityposturefindingActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Create: A finding was created.

        2 - Update: A finding was updated.

        3 - Close: A finding was closed.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding:
      title: >-
        ocsfv1.5.0applicationsecurityposturefindingApplicationSecurityPostureFinding
      type: object
      description: >-
        The Application Security Posture Finding event is a notification about
        any bug, defect, deficiency, exploit, vulnerability, weakness or any
        other issue with software and related systems. Application Security
        Posture Findings typically involve reporting on the greater context
        including compliance, impacted resources, remediation guidance, specific
        code defects, and/or vulnerability metadata. Application Security
        Posture Findings can be reported by Threat &amp; Vulnerability
        Management (TVM) tools, Application Security Posture Management (ASPM)
        tools, or other similar tools. Note: if the event producer is a security
        control, the <code>security_control</code> profile should be applied and
        its <code>attacks</code> information, if present, should be duplicated
        into the <code>finding_info</code> object. <br /><strong>Note:
        </strong>If the Finding is an incident, i.e. requires incident workflow,
        also apply the <code>incident</code> profile or aggregate this finding
        into an <code>Incident Finding</code>.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingActionId
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. An unknown action may still correspond
            to a known disposition. Refer to <code>disposition_id</code> for the
            outcome of the action.
        activity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingActivityId
          description: The normalized identifier of the finding activity.
        activity_name:
          type: string
          nullable: true
          description: >-
            The finding activity name, as defined by the
            <code>activity_id</code>.
        actor:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingActor
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity. Note that this is not the threat
            actor of a campaign but may be part of a campaign.
        api:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        application:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplication
          nullable: true
          description: >-
            An Application describes the details for an inventoried application
            as reported by an Application Security tool or other
            Developer-centric tooling. Applications can be defined as Kubernetes
            resources, Containerized resources, or application hosting-specific
            cloud sources such as AWS Elastic BeanStalk, AWS Lightsail, or Azure
            Logic Apps.
        attacks:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAttack
          nullable: true
          description: >-
            An array of MITRE ATT&amp;CK® objects describing identified tactics,
            techniques &amp; sub-techniques. The objects are compatible with
            MITRE ATLAS™ tactics, techniques &amp; sub-techniques.
        authorizations:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAuthorization
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Findings</code>.
        category_uid:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCategoryUid
          description: The category unique identifier of the event.
        class_uid:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingClassUid
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCloud
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        comment:
          type: string
          nullable: true
          description: A user provided comment about the finding.
        compliance:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCompliance
          nullable: true
          description: >-
            Provides compliance context to vulnerabilities and other weaknesses
            that are reported as part of an Application Security or
            Vulnerability Management tool's built-in compliance framework
            mapping.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: A list of custom fields
        device:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDevice
          nullable: true
          description: >-
            Describes the affected device/host. It can be used in conjunction
            with <code>Affected Resource(s)</code>. <p> e.g. Specific details
            about an AWS EC2 instance, that is affected by the Finding.</p>
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDispositionId
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time of the most recent event included in the finding.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the most recent event included in the finding.
        enrichments:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEnrichment
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        finding_info:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFindingInfo
          description: Describes the supporting information about a generated finding.
        firewall_rule:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFirewallRule
          nullable: true
          description: >-
            The firewall rule that pertains to the control that triggered the
            event, if applicable.
        is_alert:
          type: boolean
          nullable: true
          description: >-
            Indicates that the event is considered to be an alertable signal.
            Should be set to <code>true</code> if <code>disposition_id =
            Alert</code> among other dispositions, and/or
            <code>risk_level_id</code> or <code>severity_id</code> of the event
            is elevated. Not all control events will be alertable, for example
            if <code>disposition_id = Exonerated</code> or <code>disposition_id
            = Allowed</code>.
        malware:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMalware
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        malware_scan_info:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMalwareScanInfo
          nullable: true
          description: >-
            Describes details about the scan job that identified malware on the
            target system.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMetadata
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObservable
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOsint
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPolicy
          nullable: true
          description: >-
            The policy that pertains to the control that triggered the event, if
            applicable. For example the name of an anti-malware policy or an
            access control policy.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        raw_data_size:
          type: integer
          nullable: true
          description: >-
            The size of the raw data which was transformed into an OCSF event,
            in bytes.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRemediation
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            vulnerabilities or weaknesses.
        resources:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingResourceDetails
          nullable: true
          description: >-
            Describes details about the resource/resources that are affected by
            the vulnerability/vulnerabilities.
        risk_details:
          type: string
          nullable: true
          description: Describes the risk associated with the finding.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            <code>severity_id</code> value. In the case of 'Other', it is
            defined by the source.
        severity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSeverityId
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        start_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time of the least recent event included in the finding.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time of the least recent event included in the finding.
        status:
          type: string
          nullable: true
          description: >-
            The normalized status of the Finding set by the consumer normalized
            to the caption of the status_id value. In the case of 'Other', it is
            defined by the source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingStatusId
          nullable: true
          description: >-
            The normalized status identifier of the Finding, set by the
            consumer.
        time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTypeUid
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
        vendor_attributes:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingVendorAttributes
          nullable: true
          description: >-
            The Vendor Attributes object can be used to represent values of
            attributes populated by the Vendor/Finding Provider. It can help
            distinguish between the vendor-prodvided values and consumer-updated
            values, of key attributes like <code>severity_id</code>.<br>The
            original finding producer should not populate this object. It should
            be populated by consuming systems that support data mutability.
        vulnerabilities:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingVulnerability
          nullable: true
          description: >-
            This object describes vulnerabilities reported in a security
            finding.
      required:
        - activity_id
        - category_uid
        - class_uid
        - finding_info
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.5.0applicationsecurityposturefindingCategoryUid:
      title: ocsfv1.5.0applicationsecurityposturefindingCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        2 - Findings: Findings events report findings, detections, and possible
        resolutions of malware, anomalies, or other actions performed by
        security products.
    ocsfv1.5.0applicationsecurityposturefindingClassUid:
      title: ocsfv1.5.0applicationsecurityposturefindingClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        2007 - ApplicationSecurityPostureFinding: The Application Security
        Posture Finding event is a notification about any bug, defect,
        deficiency, exploit, vulnerability, weakness or any other issue with
        software and related systems. Application Security Posture Findings
        typically involve reporting on the greater context including compliance,
        impacted resources, remediation guidance, specific code defects, and/or
        vulnerability metadata. Application Security Posture Findings can be
        reported by Threat &amp; Vulnerability Management (TVM) tools,
        Application Security Posture Management (ASPM) tools, or other similar
        tools. Note: if the event producer is a security control, the
        <code>security_control</code> profile should be applied and its
        <code>attacks</code> information, if present, should be duplicated into
        the <code>finding_info</code> object. <br /><strong>Note: </strong>If
        the Finding is an incident, i.e. requires incident workflow, also apply
        the <code>incident</code> profile or aggregate this finding into an
        <code>Incident Finding</code>.
    ocsfv1.5.0applicationsecurityposturefindingConfidenceId:
      title: ocsfv1.5.0applicationsecurityposturefindingConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingDispositionId:
      title: ocsfv1.5.0applicationsecurityposturefindingDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingRiskLevelId:
      title: ocsfv1.5.0applicationsecurityposturefindingRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingSeverityId:
      title: ocsfv1.5.0applicationsecurityposturefindingSeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingStatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - New: The Finding is new and yet to be reviewed.

        2 - InProgress: The Finding is under review.

        3 - Suppressed: The Finding was reviewed, determined to be benign or a
        false positive and is now suppressed.

        4 - Resolved: The Finding was reviewed, remediated and is now considered
        resolved.

        5 - Archived: The Finding was archived.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingTypeUid:
      title: ocsfv1.5.0applicationsecurityposturefindingTypeUid
      type: integer
      description: |-
        TypeUid is an enum, and the following values are allowed.
        200700 - Unknown
        200701 - Create: A finding was created.
        200702 - Update: A finding was updated.
        200703 - Close: A finding was closed.
        200799 - Other
    ocsfv1.5.0applicationsecurityposturefindingAccount:
      title: ocsfv1.5.0applicationsecurityposturefindingAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
        Additionally, the Account object refers to logical Cloud and
        Software-as-a-Service (SaaS) based containers such as AWS Accounts,
        Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects,
        and otherwise.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the account.
        name:
          type: string
          nullable: true
          description: >-
            The name of the account (e.g. <code> GCP Project name </code>,
            <code> Linux Account name </code> or <code> AWS Account
            name</code>).
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            account.
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAccount_TypeId
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the account (e.g. <code> AWS Account ID
            </code>, <code> OCID </code>, <code> GCP Project ID </code>, <code>
            Azure Subscription ID </code>, <code> Google Workspace Customer ID
            </code>, or <code> M365 Tenant UID</code>).
    ocsfv1.5.0applicationsecurityposturefindingAccount_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        11 - GCPProject
        12 - OCICompartment
        13 - AzureSubscription
        14 - SalesforceAccount
        15 - GoogleWorkspace
        16 - ServicenowInstance
        17 - M365Tenant
        18 - EmailAccount
        99 - Other: The account type is not mapped.
    ocsfv1.5.0applicationsecurityposturefindingActor:
      title: ocsfv1.5.0applicationsecurityposturefindingActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
        Note that Actor is not the threat actor of a campaign but may be part of
        a campaign.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingActor_ActorTypeId
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAuthorization
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProcess
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSession
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.5.0applicationsecurityposturefindingActor_ActorTypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingAdvisory:
      title: ocsfv1.5.0applicationsecurityposturefindingAdvisory
      type: object
      description: >-
        The Advisory object represents publicly disclosed cybersecurity
        vulnerabilities defined in a Security advisory. e.g. <code> Microsoft KB
        Article</code>, <code>Apple Security Advisory</code>, or a <code>GitHub
        Security Advisory (GHSA)</code>
      properties:
        avg_timespan:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimespan
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The Advisory bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the Advisory.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the Advisory record was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was created.
        desc:
          type: string
          nullable: true
          description: A brief description of the Advisory Record.
        install_state:
          type: string
          nullable: true
          description: The install state of the Advisory.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAdvisory_InstallStateId
          nullable: true
          description: The normalized install state ID of the Advisory.
        is_superseded:
          type: boolean
          nullable: true
          description: The Advisory has been replaced by another.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the Advisory record was last updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was last updated.
        os:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOs'
          nullable: true
          description: The operating system the Advisory applies to.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerabilities disclosed in the Advisory.
        related_cves:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCve
          nullable: true
          description: >-
            A list of Common Vulnerabilities and Exposures <a target="_blank"
            href="https://cve.mitre.org/">(CVE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        related_cwes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCwe
          nullable: true
          description: >-
            A list of Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        size:
          type: integer
          nullable: true
          description: >-
            The size in bytes for the Advisory. Usually populated for a KB
            Article patch.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The Advisory link from the source vendor.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the Advisory.
        uid:
          type: string
          description: >-
            The unique identifier assigned to the advisory or disclosed
            vulnerability, e.g, <code>GHSA-5mrr-rgp6-x4gr</code>.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingAdvisory_InstallStateId:
      title: ocsfv1.5.0applicationsecurityposturefindingAdvisory_InstallStateId
      type: integer
      description: >-
        AdvisoryInstallStateId is an enum, and the following values are allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingAffectedCode:
      title: ocsfv1.5.0applicationsecurityposturefindingAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_column:
          type: integer
          nullable: true
          description: >-
            The column number of the last part of the assessed code identified
            as vulnerable.
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRemediation
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        rule:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRule'
          nullable: true
          description: >-
            Details about the specific rule, e.g., those defined as part of a
            larger <code>policy</code>, that triggered the finding.
        start_column:
          type: integer
          nullable: true
          description: >-
            The column number of the first part of the assessed code identified
            as vulnerable.
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.5.0applicationsecurityposturefindingAffectedPackage:
      title: ocsfv1.5.0applicationsecurityposturefindingAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        path:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFilePath
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRemediation
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.5.0applicationsecurityposturefindingAffectedPackage_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingAgent:
      title: ocsfv1.5.0applicationsecurityposturefindingAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAgent_TypeId
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.5.0applicationsecurityposturefindingAgent_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingAnalytic:
      title: ocsfv1.5.0applicationsecurityposturefindingAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The algorithm used by the underlying analytic to generate the
            finding.
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: Other analytics related to this analytic.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAnalytic_TypeId
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingAnalytic_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingApi:
      title: ocsfv1.5.0applicationsecurityposturefindingApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRequest
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingResponse
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingService
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.5.0applicationsecurityposturefindingApplication:
      title: ocsfv1.5.0applicationsecurityposturefindingApplication
      type: object
      description: >-
        An Application describes the details for an inventoried application as
        reported by an Application Security tool or other Developer-centric
        tooling. Applications can be defined as Kubernetes resources,
        Containerized resources, or application hosting-specific cloud sources
        such as AWS Elastic BeanStalk, AWS Lightsail, or Azure Logic Apps.
      properties:
        criticality:
          type: string
          nullable: true
          description: The criticality of the application as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the application.
        desc:
          type: string
          nullable: true
          description: >-
            A description or commentary for an application, usually retrieved
            from an upstream system.
        group:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: The name of the related application or associated resource group.
        hostname:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingHostname
          nullable: true
          description: The fully qualified name of the application.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the application.
        name:
          type: string
          nullable: true
          description: The name of the application.
        owner:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the
            application.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        resource_relationship:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGraph
          nullable: true
          description: >-
            A graph representation showing how this application relates to and
            interacts with other entities in the environment. This can include
            parent/child relationships, dependencies, or other connections.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingApplication_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        sbom:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSbom'
          nullable: true
          description: >-
            The Software Bill of Materials (SBOM) associated with the
            application
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            application.
        type:
          type: string
          nullable: true
          description: >-
            The type of application as defined by the event source, e.g.,
            <code>GitHub</code>, <code>Azure Logic App</code>, or <code>Amazon
            Elastic BeanStalk</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the application.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the application, such as
            a configuration, organization, or license UID.
        url:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUrl'
          nullable: true
          description: The URL of the application.
        version:
          type: string
          nullable: true
          description: The semantic version of the application, e.g., <code>1.7.4</code>.
    ocsfv1.5.0applicationsecurityposturefindingApplication_RiskLevelId:
      title: ocsfv1.5.0applicationsecurityposturefindingApplication_RiskLevelId
      type: integer
      description: >-
        ApplicationRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingAssessment:
      title: ocsfv1.5.0applicationsecurityposturefindingAssessment
      type: object
      description: >-
        The Assessment object describes a point-in-time assessment, check, or
        evaluation of a specific configuration or signal against an asset,
        entity, person, or otherwise. For example, this can encapsulate
        <code>os_signals</code> from CrowdStrike Falcon Zero Trust Assessments,
        or account for <code>Datastore</code> configurations from Cyera, or
        capture details of Microsoft Intune configuration policies.
      properties:
        category:
          type: string
          nullable: true
          description: >-
            The category that the assessment is part of. For example:
            <code>Prevention</code> or <code>Windows 10</code>.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the assessment criteria, or a description of the
            specific configuration or signal the assessment is targeting.
        meets_criteria:
          type: boolean
          description: >-
            Determines whether the assessment against the specific configuration
            or signal meets the assessments criteria. For example, if the
            assessment checks if a <code>Datastore</code> is encrypted or not,
            having encryption would be evaluated as <code>true</code>.
        name:
          type: string
          nullable: true
          description: >-
            The name of the configuration or signal being assessed. For example:
            <code>Kernel Mode Code Integrity (KMCI)</code> or
            <code>publicAccessibilityState</code>.
        policy:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPolicy
          nullable: true
          description: The details of any policy associated with an assessment.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the configuration or signal being assessed.
            For example: the <code>signal_id</code>.
      required:
        - meets_criteria
    ocsfv1.5.0applicationsecurityposturefindingAttack:
      title: ocsfv1.5.0applicationsecurityposturefindingAttack
      type: object
      description: >-
        The MITRE ATT&amp;CK® &amp; ATLAS™ object describes the tactic,
        technique, sub-technique &amp; mitigation associated to an attack.
      properties:
        mitigation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMitigation
          nullable: true
          description: >-
            The Mitigation object describes the MITRE ATT&CK® or ATLAS™
            Mitigation ID and/or name that is associated to an attack.
        sub_technique:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSubTechnique
          nullable: true
          description: >-
            The Sub-technique object describes the MITRE ATT&CK® or ATLAS™
            Sub-technique ID and/or name associated to an attack.
        tactic:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTactic
          nullable: true
          description: >-
            The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID
            and/or name that is associated to an attack.
        tactics:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTactic
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTechnique
          nullable: true
          description: >-
            The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique
            ID and/or name associated to an attack.
        version:
          type: string
          nullable: true
          description: The ATT&amp;CK® or ATLAS™ Matrix version.
    ocsfv1.5.0applicationsecurityposturefindingAuthFactor:
      title: ocsfv1.5.0applicationsecurityposturefindingAuthFactor
      type: object
      description: >-
        An Authentication Factor object describes a category of methods used for
        identity verification in an authentication attempt.
      properties:
        device:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDevice
          nullable: true
          description: Device used to complete an authentication request.
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The email address used in an email-based authentication factor.
        factor_type:
          type: string
          nullable: true
          description: The type of authentication factor used in an authentication attempt.
        factor_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAuthFactor_FactorTypeId
          description: The normalized identifier for the authentication factor.
        is_hotp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is an HMAC-based One-time Password
            (HOTP).
        is_totp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is a Time-based One-time Password
            (TOTP).
        phone_number:
          type: string
          nullable: true
          description: The phone number used for a telephony-based authentication request.
        provider:
          type: string
          nullable: true
          description: The name of provider for an authentication factor.
        security_questions:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The question(s) provided to user for a question-based authentication
            factor.
      required:
        - factor_type_id
    ocsfv1.5.0applicationsecurityposturefindingAuthFactor_FactorTypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingAuthFactor_FactorTypeId
      type: integer
      description: >-
        AuthFactorFactorTypeId is an enum, and the following values are allowed.

        0 - Unknown

        1 - SMS: User receives and inputs a code sent to their mobile device via
        SMS text message.

        2 - SecurityQuestion: The user responds to a security question as part
        of a question-based authentication factor

        3 - PhoneCall: System calls the user's registered phone number and
        requires the user to answer and provide a response.

        4 - Biometric: Devices that verify identity-based on user's physical
        identifiers, such as fingerprint scanners or retina scanners.

        5 - PushNotification: Push notification is sent to user's registered
        device and requires the user to acknowledge.

        6 - HardwareToken: Physical device that generates a code to be used for
        authentication.

        7 - OTP: Application generates a one-time password (OTP) for use in
        authentication.

        8 - Email: A code or link is sent to a user's registered email address.

        9 - U2F: Typically involves a hardware token, which the user physically
        interacts with to authenticate.

        10 - WebAuthn: Web-based API that enables users to register devices as
        authentication factors.

        11 - Password: The user enters a password that they have previously
        established.

        99 - Other
    ocsfv1.5.0applicationsecurityposturefindingAuthorization:
      title: ocsfv1.5.0applicationsecurityposturefindingAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPolicy
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.5.0applicationsecurityposturefindingAutonomousSystem:
      title: ocsfv1.5.0applicationsecurityposturefindingAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.5.0applicationsecurityposturefindingCampaign:
      title: ocsfv1.5.0applicationsecurityposturefindingCampaign
      type: object
      description: >-
        Campaign represent organized efforts by threat actors to achieve
        malicious objectives over a period, often characterized by shared
        tactics, techniques, and procedures (TTPs).
      properties:
        name:
          type: string
          description: The name of a specific campaign associated with a cyber threat.
      required:
        - name
    ocsfv1.5.0applicationsecurityposturefindingCertificate:
      title: ocsfv1.5.0applicationsecurityposturefindingCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity.
      properties:
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        sans:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSan
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - issuer
        - serial_number
    ocsfv1.5.0applicationsecurityposturefindingCheck:
      title: ocsfv1.5.0applicationsecurityposturefindingCheck
      type: object
      description: >-
        The check object defines a specific, testable compliance verification
        point that evaluates a target device against a standard, framework, or
        custom requirement. While checks are typically associated with formal
        standards (like CIS, NIST, or ISO), they can also represent custom or
        organizational requirements. When mapped to controls, checks can
        evaluate specific control_parameters to determine compliance status, but
        neither the control mapping nor control_parameters are required for a
        valid check.
      properties:
        desc:
          type: string
          nullable: true
          description: >-
            The detailed description of the compliance check, explaining the
            security requirement, vulnerability, or configuration being
            assessed. For example, CIS: <code>The cramfs filesystem type is a
            compressed read-only Linux filesystem. Removing support for unneeded
            filesystem types reduces the local attack surface.</code> or DISA
            STIG: <code>Unauthorized access to the information system by foreign
            entities may result in loss or compromise of data.</code>
        name:
          type: string
          nullable: true
          description: >-
            The name or title of the compliance check. For example, CIS:
            <code>Ensure mounting of cramfs filesystems is disabled</code> or
            DISA STIG: <code>The Ubuntu operating system must implement
            DoD-approved encryption to protect the confidentiality of remote
            access sessions</code>.
        severity:
          type: string
          nullable: true
          description: >-
            The severity level as defined in the source document. For example
            CIS Benchmarks, valid values are: <code>Level 1</code>
            (security-forward, essential settings), <code>Level 2</code>
            (security-focused environment, more restrictive), or
            <code>Scored/Not Scored</code> (whether compliance can be
            automatically checked). For DISA STIG, valid values are: <code>CAT
            I</code> (maps to severity_id 5/Critical), <code>CAT II</code> (maps
            to severity_id 4/High), or <code>CAT III</code> (maps to severity_id
            3/Medium).
        severity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCheck_SeverityId
          nullable: true
          description: >-
            The normalized severity identifier that maps severity levels to
            standard severity levels. For example CIS Benchmark: <code>Level
            2</code> maps to <code>4</code> (High), <code>Level 1</code> maps to
            <code>3</code> (Medium). For DISA STIG: <code>CAT I</code> maps to
            <code>5</code> (Critical), <code>CAT II</code> maps to
            <code>4</code> (High), and <code>CAT III</code> maps to
            <code>3</code> (Medium).
        standards:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The regulatory or industry standard this check is associated with.
            E.g., <code>PCI DSS 3.2.1</code>, <code>HIPAA Security Rule</code>,
            <code>NIST SP 800-53 Rev. 5</code>, or <code>ISO/IEC
            27001:2013</code>.
        status:
          type: string
          nullable: true
          description: >-
            The resultant status of the compliance check normalized to the
            caption of the <code>status_id</code> value. For example, CIS
            Benchmark: <code>Pass</code> when all requirements are met,
            <code>Fail</code> when requirements are not met, or DISA STIG:
            <code>NotAFinding</code> (maps to status_id 1/Pass),
            <code>Open</code> (maps to status_id 3/Fail).
        status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCheck_StatusId
          nullable: true
          description: The normalized status identifier of the compliance check.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the compliance check within its standard or
            framework. For example, CIS Benchmark identifier
            <code>1.1.1.1</code>, DISA STIG identifier <code>V-230234</code>, or
            NIST control identifier <code>AC-17(2)</code>.
        version:
          type: string
          nullable: true
          description: >-
            The check version. For example, CIS Benchmark: <code>1.1.0</code>
            for Amazon Linux 2 or DISA STIG: <code>V2R1</code> for Windows 10.
    ocsfv1.5.0applicationsecurityposturefindingCheck_SeverityId:
      title: ocsfv1.5.0applicationsecurityposturefindingCheck_SeverityId
      type: integer
      description: >-
        CheckSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Maps to CIS Benchmark <code>Level 1</code> - Essential
        security settings recommended for all systems, or DISA STIG <code>CAT
        III</code> - Action is required but the situation is not serious at this
        time.

        4 - High: Maps to CIS Benchmark <code>Level 2</code> - More restrictive
        and security-focused settings for sensitive environments, or DISA STIG
        <code>CAT II</code> - Action is required immediately.

        5 - Critical: Maps to DISA STIG <code>CAT I</code> - Action is required
        immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The severity is not mapped. See the <code>severity</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingCheck_StatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingCheck_StatusId
      type: integer
      description: >-
        CheckStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Pass: The compliance check passed for all the evaluated resources.

        2 - Warning: The compliance check did not yield a result due to missing
        information.

        3 - Fail: The compliance check failed for at least one of the evaluated
        resources.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingCisControl:
      title: ocsfv1.5.0applicationsecurityposturefindingCisControl
      type: object
      description: >-
        The CIS Control (aka Critical Security Control) object describes a
        prioritized set of actions to protect your organization and data from
        cyber-attack vectors. The <a target="_blank"
        href="https://www.cisecurity.org/controls">CIS Controls</a> are defined
        by the Center for Internet Security.
      properties:
        desc:
          type: string
          nullable: true
          description: >-
            The CIS Control description. For example: <i>Uninstall or disable
            unnecessary services on enterprise assets and software, such as an
            unused file sharing service, web application module, or service
            function.</i>
        name:
          type: string
          description: >-
            The CIS Control name. For example: <i>4.8 Uninstall or Disable
            Unnecessary Services on Enterprise Assets and Software.</i>
        version:
          type: string
          nullable: true
          description: 'The CIS Control version. For example: <i>v8</i>.'
      required:
        - name
    ocsfv1.5.0applicationsecurityposturefindingCloud:
      title: ocsfv1.5.0applicationsecurityposturefindingCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud or
        Software-as-a-Service account or similar construct, such as AWS Account
        ID, regions, organizations, folders, compartments, tenants, etc.
      properties:
        account:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAccount
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        org:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOrganization
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.5.0applicationsecurityposturefindingCompliance:
      title: ocsfv1.5.0applicationsecurityposturefindingCompliance
      type: object
      description: >-
        The Compliance object contains information about Industry and Regulatory
        Framework standards, controls and requirements or details about custom
        assessments utilized in a compliance evaluation. Standards define broad
        security frameworks, controls represent specific security requirements
        within those frameworks, and checks are the testable verification points
        used to determine if controls are properly implemented.
      properties:
        assessments:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAssessment
          nullable: true
          description: >-
            A list of assessments associated with the compliance requirements
            evaluation.
        category:
          type: string
          nullable: true
          description: >-
            The category a control framework pertains to, as reported by the
            source tool, such as <code>Asset Management</code> or <code>Risk
            Assessment</code>.
        checks:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCheck
          nullable: true
          description: >-
            A list of compliance checks associated with specific industry
            standards or frameworks. Each check represents an individual rule or
            requirement that has been evaluated against a target device. Checks
            typically include details such as the check name (e.g., CIS: 'Ensure
            mounting of cramfs filesystems is disabled' or DISA STIG descriptive
            titles), unique identifiers (such as CIS identifier '1.1.1.1' or
            DISA STIG identifier 'V-230234'), descriptions (detailed
            explanations of security requirements or vulnerability discussions),
            and version information.
        compliance_references:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKbArticle
          nullable: true
          description: >-
            A list of reference KB articles that provide information to help
            organizations understand, interpret, and implement compliance
            standards. They provide guidance, best practices, and examples.
        compliance_standards:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKbArticle
          nullable: true
          description: >-
            A list of established guidelines or criteria that define specific
            requirements an organization must follow.
        control:
          type: string
          nullable: true
          description: >-
            A Control is a prescriptive, actionable set of specifications that
            strengthens device posture. The control specifies required security
            measures, while the specific implementation values are defined in
            control_parameters. E.g., CIS AWS Foundations Benchmark 1.2.0 -
            Control 2.1 - Ensure CloudTrail is enabled in all regions
        control_parameters:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of control parameters evaluated in a Compliance check.
            E.g., parameters for CloudTrail configuration might include
            <code>multiRegionTrailEnabled: true</code>,
            <code>logFileValidationEnabled: true</code>, and
            <code>requiredRegions: [us-east-1, us-west-2]</code>
        desc:
          type: string
          nullable: true
          description: The description or criteria of a control.
        requirements:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The specific compliance requirements being evaluated. E.g.,
            <code>PCI DSS Requirement 8.2.3 - Passwords must meet minimum
            complexity requirements</code> or <code>HIPAA Security Rule
            164.312(a)(2)(iv) - Implement encryption and decryption
            mechanisms</code>
        standards:
          type: array
          items:
            type: string
          nullable: true
          description: The regulatory or industry standards being evaluated for compliance.
        status:
          type: string
          nullable: true
          description: >-
            The resultant status of the compliance check normalized to the
            caption of the <code>status_id</code> value. In the case of 'Other',
            it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: The resultant status code of the compliance check.
        status_detail:
          type: string
          nullable: true
          description: >-
            The contextual description of the <code>status, status_code</code>
            values.
        status_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of contextual descriptions of the <code>status,
            status_code</code> values.
        status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCompliance_StatusId
          nullable: true
          description: The normalized status identifier of the compliance check.
    ocsfv1.5.0applicationsecurityposturefindingCompliance_StatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingCompliance_StatusId
      type: integer
      description: >-
        ComplianceStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Pass: The compliance check passed for all the evaluated resources.

        2 - Warning: The compliance check did not yield a result due to missing
        information.

        3 - Fail: The compliance check failed for at least one of the evaluated
        resources.

        99 - Other: The event status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingContainer:
      title: ocsfv1.5.0applicationsecurityposturefindingContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingImage
          nullable: true
          description: The container image used as a template to run the container.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            container.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.5.0applicationsecurityposturefindingCve:
      title: ocsfv1.5.0applicationsecurityposturefindingCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCvss
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        related_cwes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCwe
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> details related to the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingCvss:
      title: ocsfv1.5.0applicationsecurityposturefindingCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCvss_Depth
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMetric
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The source URL for the CVSS score. For example:
            <code>https://nvd.nist.gov/vuln/detail/CVE-2021-44228</code>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor that provided the CVSS score. For example: <code>NVD,
            REDHAT</code> etc.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.5.0applicationsecurityposturefindingCvss_Depth:
      title: ocsfv1.5.0applicationsecurityposturefindingCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.5.0applicationsecurityposturefindingCwe:
      title: ocsfv1.5.0applicationsecurityposturefindingCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingD3fTactic:
      title: ocsfv1.5.0applicationsecurityposturefindingD3fTactic
      type: object
      description: >-
        The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that
        is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the defensive technique. For
            example: <code>Isolate</code>.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The versioned permalink of the defensive tactic. For example:
            <code>https://d3fend.mitre.org/tactic/d3f:Isolate/</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the defensive tactic.
    ocsfv1.5.0applicationsecurityposturefindingD3fTechnique:
      title: ocsfv1.5.0applicationsecurityposturefindingD3fTechnique
      type: object
      description: >-
        The MITRE D3FEND™ Technique object describes the leaf defensive
        technique ID and/or name associated to a countermeasure.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the defensive technique. For example: <code>IO Port
            Restriction</code>.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The versioned permalink of the defensive technique. For example:
            <code>https://d3fend.mitre.org/technique/d3f:IOPortRestriction/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the defensive technique. For example:
            <code>D3-IOPR</code>.
    ocsfv1.5.0applicationsecurityposturefindingD3fend:
      title: ocsfv1.5.0applicationsecurityposturefindingD3fend
      type: object
      description: >-
        The MITRE D3FEND™ object describes the tactic &amp; technique associated
        with a countermeasure.
      properties:
        d3f_tactic:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingD3fTactic
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated with a countermeasure.
        d3f_technique:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingD3fTechnique
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated with a countermeasure.
        version:
          type: string
          nullable: true
          description: The D3FEND™ Matrix version.
    ocsfv1.5.0applicationsecurityposturefindingDevice:
      title: ocsfv1.5.0applicationsecurityposturefindingDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
      properties:
        agent_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAgent
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        boot_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier of the device that changes after every reboot.
            For example, the value of
            <code>/proc/sys/kernel/random/boot_id</code> from Linux's procfs.
        container:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingContainer
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        eid:
          type: string
          nullable: true
          description: >-
            An Embedded Identity Document, is a unique serial number that
            identifies an eSIM-enabled device.
        first_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingHostname
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDeviceHwInfo
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        iccid:
          type: string
          nullable: true
          description: >-
            The Integrated Circuit Card Identification of a mobile device.
            Typically it is a unique 18 to 22 digit number that identifies a SIM
            card.
        image:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingImage
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity that is associated with
            the device.
        imei_list:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity values that are
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingIPAddress
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_backed_up:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device or resource has a backup enabled, such
            as an automated snapshot or a cloud backup. For example, this is
            indicated by the <code>cloudBackupEnabled</code> value within JAMF
            Pro mobile devices or the registration of an AWS ARN with the AWS
            Backup service.
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_mobile_account_active:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device has an active mobile account. For
            example, this is indicated by the
            <code>itunesStoreAccountActive</code> value within JAMF Pro mobile
            devices.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_shared:
          type: boolean
          nullable: true
          description: The event occurred on a shared device.
        is_supervised:
          type: boolean
          nullable: true
          description: >-
            The event occurred on a supervised device. Devices that are
            supervised are typically mobile devices managed by a Mobile Device
            Management solution and are restricted from specific behaviors such
            as Apple AirDrop.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLocation
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMACAddress
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        meid:
          type: string
          nullable: true
          description: >-
            The Mobile Equipment Identifier. It's a unique number that
            identifies a Code Division Multiple Access (CDMA) mobile device.
        model:
          type: string
          nullable: true
          description: >-
            The model of the device. For example <code>ThinkPad X1
            Carbon</code>.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingNetworkInterface
          nullable: true
          description: >-
            The physical or virtual network interfaces that are associated with
            the device, one for each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOrganization
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOs'
          nullable: true
          description: The endpoint operating system.
        os_machine_uuid:
          type: string
          nullable: true
          description: >-
            The operating system assigned Machine ID. In Windows, this is the
            value stored at the registry path:
            <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid</code>.
            In Linux, this is stored in the file: <code>/etc/machine-id</code>.
        owner:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDevice_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSubnet
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDevice_TypeId
          description: The device type ID.
        udid:
          type: string
          nullable: true
          description: >-
            The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS,
            tvOS, watchOS and visionOS devices, this is the UDID. For macOS
            devices, it is the Provisioning UDID. For example:
            <code>00008020-008D4548007B4F26</code>
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOrganization
          nullable: true
          description: The product vendor that created the device.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor for the device. For example <code>Dell</code> or
            <code>Lenovo</code>.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingDevice_NetworkStatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.5.0applicationsecurityposturefindingDevice_RiskLevelId:
      title: ocsfv1.5.0applicationsecurityposturefindingDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingDevice_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingDeviceHwInfo:
      title: ocsfv1.5.0applicationsecurityposturefindingDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_architecture:
          type: string
          nullable: true
          description: >-
            The CPU architecture, normalized to the caption of the
            <code>cpu_architecture_id</code> value. In the case of
            <code>Other</code>, it is defined by the source.
        cpu_architecture_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDeviceHwInfo_CpuArchitectureId
          nullable: true
          description: The normalized identifier of the CPU architecture.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDisplay
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyboardInfo
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
        uuid:
          type: string
          nullable: true
          description: >-
            The device manufacturer assigned universally unique hardware
            identifier. For SMBIOS compatible devices such as those running
            Linux and Windows, it is the UUID member of the System Information
            structure in the SMBIOS information. For macOS devices, it is the
            Hardware UUID (also known as IOPlatformUUID in the I/O Registry).
        vendor_name:
          type: string
          nullable: true
          description: The device manufacturer.
    ocsfv1.5.0applicationsecurityposturefindingDeviceHwInfo_CpuArchitectureId:
      title: >-
        ocsfv1.5.0applicationsecurityposturefindingDeviceHwInfo_CpuArchitectureId
      type: integer
      description: >-
        DeviceHwInfoCpuArchitectureId is an enum, and the following values are
        allowed.

        0 - Unknown: The CPU architecture is unknown.

        1 - x86: CPU uses the x86 ISA. For bitness, refer to
        <code>cpu_bits</code>.

        2 - ARM: CPU uses the ARM ISA. For bitness, refer to
        <code>cpu_bits</code>.

        3 - V: CPU uses the RISC-V ISA. For bitness, refer to
        <code>cpu_bits</code>.

        99 - Other: The CPU architecture is not mapped. See the
        <code>cpu_architecture</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingDigitalSignature:
      title: ocsfv1.5.0applicationsecurityposturefindingDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCertificate
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.5.0applicationsecurityposturefindingDigitalSignature_AlgorithmId:
      title: ocsfv1.5.0applicationsecurityposturefindingDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingDigitalSignature_StateId:
      title: ocsfv1.5.0applicationsecurityposturefindingDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingDisplay:
      title: ocsfv1.5.0applicationsecurityposturefindingDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.5.0applicationsecurityposturefindingDnsAnswer:
      title: ocsfv1.5.0applicationsecurityposturefindingDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.5.0applicationsecurityposturefindingDnsAnswer_FlagIds:
      title: ocsfv1.5.0applicationsecurityposturefindingDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingDomainContact:
      title: ocsfv1.5.0applicationsecurityposturefindingDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The user's primary email address.
        location:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLocation
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingDomainContact_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingEdge:
      title: ocsfv1.5.0applicationsecurityposturefindingEdge
      type: object
      description: Represents a connection or relationship between two nodes in a graph.
      properties:
        data:
          nullable: true
          description: >-
            Additional data about the edge such as weight, distance, or custom
            properties.
        is_directed:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the edge is (<code>true</code>) or undirected
            (<code>false</code>).
        name:
          type: string
          nullable: true
          description: The human-readable name or label for the edge.
        relation:
          type: string
          nullable: true
          description: >-
            The type of relationship between nodes (e.g. is-attached-to ,
            depends-on, etc).
        source:
          type: string
          description: The unique identifier of the node where the edge originates.
        target:
          type: string
          description: The unique identifier of the node where the edge terminates.
        uid:
          type: string
          nullable: true
          description: Unique identifier of the edge.
      required:
        - source
        - target
    ocsfv1.5.0applicationsecurityposturefindingEmail:
      title: ocsfv1.5.0applicationsecurityposturefindingEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction, and can include embedded URLs and files.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: >-
            The machine-readable email header Cc values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>.
        cc_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Cc Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        delivered_to:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            field. For example <code>example.user@usersdomain.com</code>
        delivered_to_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            values. For example <code>example.user@usersdomain.com</code>
        files:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile
          nullable: true
          description: The files embedded or attached to the email.
        from:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: >-
            The machine-readable email header From values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        from_mailbox:
          type: string
          nullable: true
          description: >-
            The human-readable email header From Mailbox value. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        http_headers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingHttpHeader
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        is_read:
          type: boolean
          nullable: true
          description: The indication of whether the email has been read.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-ID value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: >-
            The machine-readable email header Reply-To values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Reply To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: >-
            The machine-readable email header To values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>
        to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the email thread.
        urls:
          type: array
          items:
            type: string
          nullable: true
          description: The URLs embedded in the email.
        x_originating_ip:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingIPAddress
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
    ocsfv1.5.0applicationsecurityposturefindingEmailAuth:
      title: ocsfv1.5.0applicationsecurityposturefindingEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.5.0applicationsecurityposturefindingEncryptionDetails:
      title: ocsfv1.5.0applicationsecurityposturefindingEncryptionDetails
      type: object
      description: Details about the encrytpion methodology utilized.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The encryption algorithm used, normalized to the caption of
            'algorithm_id
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEncryptionDetails_AlgorithmId
          nullable: true
          description: The encryption algorithm used.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key used.
        key_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the key used for encrpytion. For example,
            AWS KMS Key ARN.
        type:
          type: string
          nullable: true
          description: The type of the encryption used.
    ocsfv1.5.0applicationsecurityposturefindingEncryptionDetails_AlgorithmId:
      title: ocsfv1.5.0applicationsecurityposturefindingEncryptionDetails_AlgorithmId
      type: integer
      description: >-
        EncryptionDetailsAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DES: Data Encryption Standard Algorithm

        2 - TripleDES: Triple Data Encryption Standard Algorithm

        3 - AES: Advanced Encryption Standard Algorithm.

        4 - RSA: Rivest-Shamir-Adleman Algorithm

        5 - ECC: Elliptic Curve Cryptography Algorithm

        6 - SM2: ShangMi Cryptographic Algorithm

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingEnrichment:
      title: ocsfv1.5.0applicationsecurityposturefindingEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingReputation
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.5.0applicationsecurityposturefindingEnvironmentVariable:
      title: ocsfv1.5.0applicationsecurityposturefindingEnvironmentVariable
      type: object
      description: An environment variable.
      properties:
        name:
          type: string
          description: The name of the environment variable.
        value:
          type: string
          description: The value of the environment variable.
      required:
        - name
        - value
    ocsfv1.5.0applicationsecurityposturefindingEpss:
      title: ocsfv1.5.0applicationsecurityposturefindingEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.5.0applicationsecurityposturefindingExtension:
      title: ocsfv1.5.0applicationsecurityposturefindingExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.5.0applicationsecurityposturefindingFeature:
      title: ocsfv1.5.0applicationsecurityposturefindingFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.5.0applicationsecurityposturefindingFile:
      title: ocsfv1.5.0applicationsecurityposturefindingFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
      properties:
        accessed_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        drive_type:
          type: string
          nullable: true
          description: >-
            The drive type, normalized to the caption of the
            <code>drive_type_id</code> value. In the case of <code>Other</code>,
            it is defined by the source.
        drive_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile_DriveTypeId
          nullable: true
          description: Identifies the type of a disk drive, i.e. fixed, removable, etc.
        encryption_details:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEncryptionDetails
          nullable: true
          description: >-
            The encryption details of the file. Should be populated if the file
            is encrypted.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: An array of hash attributes.
        internal_name:
          type: string
          nullable: true
          description: >-
            The name of the file as identified within the file itself. This
            contrasts with the name by which the file is known on disk. Where
            available, the internal name is widely used by security
            practitioners and detection content because the on-disk file name is
            not reliable. On the Windows OS, most PE files contain a <a
            href="https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource">VERSIONINFO</a>
            resource from which the internal name can be obtained. On macOS,
            binaries can optionally embed a copy of the application's Info.plist
            file which in turn contains the name of the executable.
        is_deleted:
          type: boolean
          nullable: true
          description: Indicates if the file was deleted from the filesystem.
        is_encrypted:
          type: boolean
          nullable: true
          description: Indicates if the file is encrypted.
        is_public:
          type: boolean
          nullable: true
          description: >-
            Indicates if the file is publicly accessible. For example in an
            object's public access in AWS S3
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFileName
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFilePath
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDigitalSignature
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        storage_class:
          type: string
          nullable: true
          description: >-
            The storage class of the file. For example in AWS S3:
            <code>STANDARD, STANDARD_IA, GLACIER</code>.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            file.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile_TypeId
          description: The file type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        uri:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The file URI, such as those reporting by static analysis tools.
            E.g.,
            <code>file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js</code>
        url:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUrl'
          nullable: true
          description: The URL of the file, when applicable.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        volume:
          type: string
          nullable: true
          description: The volume on the storage device where the file is located.
        xattributes:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingFile_ConfidentialityId:
      title: ocsfv1.5.0applicationsecurityposturefindingFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingFile_DriveTypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingFile_DriveTypeId
      type: integer
      description: >-
        FileDriveTypeId is an enum, and the following values are allowed.

        0 - Unknown: The drive type is unknown.

        1 - Removable: The drive has removable media; for example, a floppy
        drive, thumb drive, or flash card reader.

        2 - Fixed: The drive has fixed media; for example, a hard disk drive or
        flash drive.

        3 - Remote: The drive is a remote (network) drive.

        4 - ROM: The drive is a CD-ROM drive.

        5 - RAMDisk: The drive is a RAM disk.

        99 - Other: The drive type is not mapped. See the
        <code>drive_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingFile_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingFindingInfo:
      title: ocsfv1.5.0applicationsecurityposturefindingFindingInfo
      type: object
      description: >-
        The Finding Information object describes metadata related to a security
        finding generated by a security tool or system.
      properties:
        analytic:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAnalytic
          nullable: true
          description: >-
            The analytic technique used to analyze and derive insights from the
            data or information that led to the finding or conclusion.
        attacks:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAttack
          nullable: true
          description: >-
            The <a target="_blank" href="https://attack.mitre.org">MITRE
            ATT&amp;CK®</a> technique and associated tactics related to the
            finding.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was created.
        data_sources:
          type: array
          items:
            type: string
          nullable: true
          description: A list of data sources utilized in generation of the finding.
        desc:
          type: string
          nullable: true
          description: The description of the reported finding.
        first_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed. <p>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.</p>
        kill_chain:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKillChainPhase
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed. <p>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.</p>
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the finding was last modified.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: Details about the product that reported the finding.
        product_uid:
          type: string
          nullable: true
          description: The unique identifier of the product that reported the finding.
        related_analytics:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAnalytic
          nullable: true
          description: Other analytics related to this finding.
        related_events:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRelatedEvent
          nullable: true
          description: >-
            Describes events and/or other findings related to the finding as
            identified by the security product. Note that these events may or
            may not be in OCSF.
        related_events_count:
          type: integer
          nullable: true
          description: Number of related events or findings.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The URL pointing to the source of the finding.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated with the
            finding.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the reported finding.
        traits:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTrait
          nullable: true
          description: >-
            The list of key traits or characteristics extracted from the
            finding.
        types:
          type: array
          items:
            type: string
          nullable: true
          description: One or more types of the reported finding.
        uid:
          type: string
          description: The unique identifier of the reported finding.
        uid_alt:
          type: string
          nullable: true
          description: The alternative unique identifier of the reported finding.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingFingerprint:
      title: ocsfv1.5.0applicationsecurityposturefindingFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of <code>algorithm_id</code>. In the case
            of <code>Other</code>, it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.5.0applicationsecurityposturefindingFingerprint_AlgorithmId:
      title: ocsfv1.5.0applicationsecurityposturefindingFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingFirewallRule:
      title: ocsfv1.5.0applicationsecurityposturefindingFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.5.0applicationsecurityposturefindingGraph:
      title: ocsfv1.5.0applicationsecurityposturefindingGraph
      type: object
      description: A graph data structure representation with nodes and edges.
      properties:
        desc:
          type: string
          nullable: true
          description: >-
            The graph description - provides additional details about the
            graph's purpose and contents.
        edges:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEdge
          nullable: true
          description: >-
            The edges/connections between nodes in the graph - contains the
            collection of <code>edge</code> objects defining relationships
            between nodes.
        is_directed:
          type: boolean
          nullable: true
          description: >-
            Indicates if the graph is directed (<code>true</code>) or undirected
            (<code>false</code>).
        name:
          type: string
          nullable: true
          description: The graph name - a human readable identifier for the graph.
        nodes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingNode
          description: >-
            The nodes/vertices of the graph - contains the collection of
            <code>node</code> objects that make up the graph.
        query_language:
          type: string
          nullable: true
          description: >-
            The graph query language, normalized to the caption of the
            <code>query_language_id</code> value.
        query_language_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGraph_QueryLanguageId
          nullable: true
          description: >-
            The normalized identifier of a graph query language that can be used
            to interact with the graph.
        type:
          type: string
          nullable: true
          description: >-
            The graph type. Typically useful to represent the specifc type of
            graph that is used.
        uid:
          type: string
          nullable: true
          description: >-
            Unique identifier of the graph - a unique ID to reference this
            specific graph.
      required:
        - nodes
    ocsfv1.5.0applicationsecurityposturefindingGraph_QueryLanguageId:
      title: ocsfv1.5.0applicationsecurityposturefindingGraph_QueryLanguageId
      type: integer
      description: >-
        GraphQueryLanguageId is an enum, and the following values are allowed.

        0 - Unknown: The Query Language is unknown.

        1 - Cypher: A declarative graph query language developed by Neo4j that
        allows for expressive and efficient querying of graph databases.

        2 - GraphQL: A query language for APIs that enables declarative data
        fetching and provides a complete description of the data in the API.

        3 - Gremlin: A graph traversal language and virtual machine developed by
        Apache TinkerPop that enables graph computing across different graph
        databases.

        4 - GQL: An ISO standard graph query language designed to provide a
        unified way to query graph databases.

        5 - CORE: A graph query language that combines features from existing
        languages while adding support for paths as first-class citizens.

        6 - PGQL: Property Graph Query Language developed by Oracle that
        provides SQL-like syntax for querying property graphs.

        7 - SPARQL: A semantic query language for databases that enables
        querying and manipulating data stored in RDF format.

        99 - Other: The Query Language is not mapped. See the
        <code>query_language</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingGroup:
      title: ocsfv1.5.0applicationsecurityposturefindingGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization, including but not
        limited to purposes of access control.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.5.0applicationsecurityposturefindingHttpHeader:
      title: ocsfv1.5.0applicationsecurityposturefindingHttpHeader
      type: object
      description: >-
        The HTTP Header object represents the headers sent in an HTTP request or
        response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the HTTP header.
        value:
          type: string
          description: The value of the HTTP header.
      required:
        - name
        - value
    ocsfv1.5.0applicationsecurityposturefindingIdp:
      title: ocsfv1.5.0applicationsecurityposturefindingIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        auth_factors:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAuthFactor
          nullable: true
          description: >-
            The Authentication Factors object describes the different types of
            Multi-Factor Authentication (MFA) methods and/or devices supported
            by the Identity Provider.
        domain:
          type: string
          nullable: true
          description: The primary domain associated with the Identity Provider.
        fingerprint:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            The fingerprint of the X.509 certificate used by the Identity
            Provider.
        has_mfa:
          type: boolean
          nullable: true
          description: The Identity Provider enforces Multi Factor Authentication (MFA).
        issuer:
          type: string
          nullable: true
          description: >-
            The unique identifier (often a URL) used by the Identity Provider as
            its issuer.
        name:
          type: string
          nullable: true
          description: The name of the Identity Provider.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol of the Identity Provider. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        scim:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingScim'
          nullable: true
          description: >-
            The System for Cross-domain Identity Management (SCIM) resource
            object provides a structured set of attributes related to SCIM
            protocols used for identity provisioning and management across
            cloud-based platforms. It standardizes user and group provisioning
            details, enabling identity synchronization and lifecycle management
            with compatible Identity Providers (IdPs) and applications. SCIM is
            defined in <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc7643'>RFC-7634</a>
        sso:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSso'
          nullable: true
          description: >-
            The Single Sign-On (SSO) object provides a structure for normalizing
            SSO attributes, configuration, and/or settings from Identity
            Providers.
        state:
          type: string
          nullable: true
          description: >-
            The configuration state of the Identity Provider, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingIdp_StateId
          nullable: true
          description: >-
            The normalized state ID of the Identity Provider to reflect its
            configuration or activation status.
        tenant_uid:
          type: string
          nullable: true
          description: The tenant ID associated with the Identity Provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the Identity Provider.
        url_string:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The URL for accessing the configuration or metadata of the Identity
            Provider.
    ocsfv1.5.0applicationsecurityposturefindingIdp_StateId:
      title: ocsfv1.5.0applicationsecurityposturefindingIdp_StateId
      type: integer
      description: >-
        IdpStateId is an enum, and the following values are allowed.

        0 - Unknown: The configuration state of the Identity Provider is
        unknown.

        1 - Active: The Identity Provider is in an Active state, or otherwise
        enabled.

        2 - Suspended: The Identity Provider is in a Suspended state.

        3 - Deprecated: The Identity Provider is in a Deprecated state, or is
        otherwise disabled.

        4 - Deleted: The Identity Provider is in a Deleted state.

        99 - Other: The configuration state of the Identity Provider is not
        mapped. See the <code>state</code> attribute, which contains a data
        source specific value.
    ocsfv1.5.0applicationsecurityposturefindingImage:
      title: ocsfv1.5.0applicationsecurityposturefindingImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the image.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFilePath
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            image.
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingKbArticle:
      title: ocsfv1.5.0applicationsecurityposturefindingKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimespan
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          description: The unique identifier for the kb article.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingKbArticle_InstallStateId:
      title: ocsfv1.5.0applicationsecurityposturefindingKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingKeyValueObject:
      title: ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
      type: object
      description: A generic object allowing to define a <code>{key:value}</code> pair.
      properties:
        name:
          type: string
          description: The name of the key.
        value:
          type: string
          nullable: true
          description: The value associated to the key.
        values:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Optional, the values associated to the key. You can populate this
            attribute, when you have multiple values for the same key.
      required:
        - name
    ocsfv1.5.0applicationsecurityposturefindingKeyboardInfo:
      title: ocsfv1.5.0applicationsecurityposturefindingKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.5.0applicationsecurityposturefindingKillChainPhase:
      title: ocsfv1.5.0applicationsecurityposturefindingKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.5.0applicationsecurityposturefindingKillChainPhase_PhaseId:
      title: ocsfv1.5.0applicationsecurityposturefindingKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingLdapPerson:
      title: ocsfv1.5.0applicationsecurityposturefindingLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        display_name:
          type: string
          nullable: true
          description: >-
            The display name of the LDAP person. According to RFC 2798, this is
            the preferred name of a person to be used when displaying entries.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLocation
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        phone_number:
          type: string
          nullable: true
          description: >-
            The telephone number of the user. Corresponds to the LDAP
            <code>Telephone-Number</code> CN.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            user.
    ocsfv1.5.0applicationsecurityposturefindingLdapPerson_EmploymentStatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingLocation:
      title: ocsfv1.5.0applicationsecurityposturefindingLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address.
      properties:
        aerial_height:
          type: string
          nullable: true
          description: >-
            Expressed as either height above takeoff location or height above
            ground level (AGL) for a UAS current location. This value is
            provided in meters and must have a minimum resolution of 1 m.
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code.<p><b>Note:</b> The two letter
            country code should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geodetic_altitude:
          type: string
          nullable: true
          description: >-
            The aircraft distance above or below the ellipsoid as measured along
            a line that passes through the aircraft and is normal to the surface
            of the WGS-84 ellipsoid. This value is provided in meters and must
            have a minimum resolution of 1 m. Special Values:
            <code>Invalid</code>, <code>No Value</code>, or <code>Unknown: -1000
            m</code>.
        geodetic_vertical_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on geodetic altitude. This is based on
            ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        horizontal_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on horizontal position. This is based
            on ADS-B NACp. Measured in meters.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        pressure_altitude:
          type: string
          nullable: true
          description: >-
            The uncorrected barometric pressure altitude (based on reference
            standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms
            that utilize 'altitude deltas' between aircraft. This value is
            provided in meters and must have a minimum resolution of 1 m..
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. For example, 'CH-VD' for
            the Canton of Vaud, Switzerland
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.5.0applicationsecurityposturefindingLogger:
      title: ocsfv1.5.0applicationsecurityposturefindingLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDevice
          nullable: true
          description: The device where the events are logged.
        event_uid:
          type: string
          nullable: true
          description: The unique identifier of the event assigned by the logger.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.5.0applicationsecurityposturefindingLongString:
      title: ocsfv1.5.0applicationsecurityposturefindingLongString
      type: object
      description: >-
        This object is a used to capture strings which may be truncated by a
        security product due to their length.
      properties:
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates that <code>value</code> has been truncated. May be omitted
            if truncation has not occurred.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The size in bytes of the string represented by <code>value</code>
            before truncation. Should be omitted if truncation has not occurred.
        value:
          type: string
          description: >-
            The string value, truncated if <code>is_truncated</code> is
            <code>true</code>.
      required:
        - value
    ocsfv1.5.0applicationsecurityposturefindingMalware:
      title: ocsfv1.5.0applicationsecurityposturefindingMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMalware_ClassificationIds
          description: The list of normalized identifiers of the malware classifications.
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCve
          nullable: true
          description: >-
            The list of Common Vulnerabilities and Exposures (CVE) identifiers
            associated with the malware. Reference: <a target="_blank"
            href="https://cve.mitre.org/">CVE</a>
        files:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile
          nullable: true
          description: >-
            The list of file objects representing files that were identified as
            infected by the malware.
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The number of files that were identified to be infected by the
            malware.
        path:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFilePath
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: >-
            The name or identifier of the security solution or service that
            provided the malware detection information.
        severity:
          type: string
          nullable: true
          description: >-
            The severity of the malware, normalized to the captions of the
            <code>severity_id</code> values. In the case of 'Other', they are
            defined by the event source.
        severity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMalware_SeverityId
          nullable: true
          description: The normalized identifier of the malware severity.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the specific malware instance, as assigned
            by the detection engine (e.g., virus signature ID or IPS rule ID).
      required:
        - classification_ids
    ocsfv1.5.0applicationsecurityposturefindingMalware_ClassificationIds:
      title: ocsfv1.5.0applicationsecurityposturefindingMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingMalware_SeverityId:
      title: ocsfv1.5.0applicationsecurityposturefindingMalware_SeverityId
      type: integer
      description: >-
        MalwareSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingMalwareScanInfo:
      title: ocsfv1.5.0applicationsecurityposturefindingMalwareScanInfo
      type: object
      description: >-
        The malware scan information object describes characteristics, metadata
        of a malware scanning job.
      properties:
        end_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        name:
          type: string
          nullable: true
          description: >-
            The administrator-supplied or application-generated name of the
            scan. For example: "Home office weekly user database scan", "Scan
            folders for viruses", "Full system virus scan"
        num_files:
          type: integer
          nullable: true
          description: The total number of files analyzed during the scan.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The total number of files identified as infected with malware during
            the scan.
        num_volumes:
          type: integer
          nullable: true
          description: >-
            The total number of storage volumes examined during the malware
            scan.
        size:
          type: integer
          nullable: true
          description: The total size in bytes of all files that were scanned.
        start_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        targets:
          type: array
          items:
            type: string
          nullable: true
          description: Hosts or IP addresses targeted by the scan.
        type:
          type: string
          nullable: true
          description: The type of scan.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMalwareScanInfo_TypeId
          description: The type id of the scan.
        uid:
          type: string
          nullable: true
          description: >-
            The application-defined unique identifier assigned to an instance of
            a scan.
        unique_malware_count:
          type: integer
          nullable: true
          description: The number of unique malware detected across all infected files.
      required:
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingMalwareScanInfo_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingMalwareScanInfo_TypeId
      type: integer
      description: >-
        MalwareScanInfoTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Manual: The scan was manually initiated by the user or
        administrator.

        2 - Scheduled: The scan was started based on scheduler.

        3 - UpdatedContent: The scan was triggered by a content update.

        4 - QuarantinedItems: The scan was triggered by newly quarantined items.

        5 - AttachedMedia: The scan was triggered by the attachment of removable
        media.

        6 - UserLogon: The scan was started due to a user logon.

        7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM)
        detection.

        99 - Other: The scan type id is not mapped. See the <code>type</code>
        attribute, which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingMetadata:
      title: ocsfv1.5.0applicationsecurityposturefindingMetadata
      type: object
      description: The Metadata object describes the metadata associated with the event.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        debug:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Debug information about non-fatal issues with this OCSF event. Each
            issue is a line in this string array.
        event_code:
          type: string
          nullable: true
          description: >-
            The <code>Event ID, Code, or Name</code> that the product uses to
            primarily identify the event.
        extension:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingExtension
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingExtension
          nullable: true
          description: The schema extensions used to create the event.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of labels attached to the event. For example:
            <code>["sample", "dev"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLogger
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            event.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        transformation_info_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTransformationInfo
          nullable: true
          description: >-
            An array of transformation info that describes the mappings or
            transforms applied to the data.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example: 1.0.0. Event
            consumers use the version to determine the available event
            attributes.
      required:
        - product
        - version
    ocsfv1.5.0applicationsecurityposturefindingMetric:
      title: ocsfv1.5.0applicationsecurityposturefindingMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.5.0applicationsecurityposturefindingMitigation:
      title: ocsfv1.5.0applicationsecurityposturefindingMitigation
      type: object
      description: >-
        The MITRE Mitigation object describes the ATT&amp;CK® or ATLAS™
        Mitigation ID and/or name that is associated to an attack.
      properties:
        countermeasures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingD3fend
          nullable: true
          description: >-
            The D3FEND countermeasures that are associated with the attack
            technique. For example: ATT&amp;CK Technique <code>T1003</code> is
            addressed by Mitigation <code>M1027</code>, and D3FEND Technique
            <code>D3-OTP</code>.
        name:
          type: string
          nullable: true
          description: >-
            The Mitigation name that is associated with the attack technique.
            For example: <code>Password Policies</code>, or <code>Code
            Signing</code>.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The versioned permalink of the Mitigation. For example:
            <code>https://attack.mitre.org/versions/v14/mitigations/M1027</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Mitigation ID that is associated with the attack technique. For
            example: <code>M1027</code>, or <code>AML.M0013</code>.
    ocsfv1.5.0applicationsecurityposturefindingNetworkInterface:
      title: ocsfv1.5.0applicationsecurityposturefindingNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a physical or virtual network interface.
      properties:
        hostname:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingHostname
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingIPAddress
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMACAddress
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingNetworkInterface_TypeId
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
      required:
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingNetworkInterface_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingNode:
      title: ocsfv1.5.0applicationsecurityposturefindingNode
      type: object
      description: Represents a node or a vertex in a graph structure.
      properties:
        data:
          nullable: true
          description: >-
            Additional data about the node stored as key-value pairs. Can
            include custom properties specific to the node.
        desc:
          type: string
          nullable: true
          description: >-
            A human-readable description of the node's purpose or meaning in the
            graph.
        name:
          type: string
          nullable: true
          description: >-
            A human-readable name or label for the node. Should be descriptive
            and unique within the graph context.
        type:
          type: string
          nullable: true
          description: >-
            Categorizes the node into a specific class or type. Useful for
            grouping and filtering nodes.
        uid:
          type: string
          description: >-
            A unique string or numeric identifier that distinguishes this node
            from all others in the graph. Must be unique across all nodes.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingObject:
      title: ocsfv1.5.0applicationsecurityposturefindingObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.5.0applicationsecurityposturefindingObservable:
      title: ocsfv1.5.0applicationsecurityposturefindingObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the OCSF event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingReputation
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObservable_TypeId
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingObservable_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. It may be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example:<br /><code>john_doe</code>.

        5 - EmailAddress: Email address. For example:<br
        /><code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example:<br /><code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example:<br />
        MD5: <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example:<br /><code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example:<br
        /><code>80</code>,<br /><code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction, and can include embedded URLs and
        files.

        23 - UniformResourceLocator: The Uniform Resource Locator (URL) object
        describes the characteristics of a URL.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details.

        25 - Process: The Process object describes a running instance of a
        launched program.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        45 - FilePath: The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingOrganization:
      title: ocsfv1.5.0applicationsecurityposturefindingOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any. Additionally, it also describes cloud
        and Software-as-a-Service (SaaS) logical hierarchies such as AWS
        Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and
        similar constructs.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the organization, Oracle Cloud Tenancy, Google Cloud
            Organization, or AWS Organization. For example, <code> Widget, Inc.
            </code> or the <code> AWS Organization name </code>.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of an organizational unit, Google Cloud Folder, or AWS Org
            Unit. For example, the <code> GCP Project Name </code>, or <code>
            Dev_Prod_OU </code>.
        ou_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of an organizational unit, Google Cloud
            Folder, or AWS Org Unit. For example, an <code> Oracle Cloud Tenancy
            ID </code>, <code> AWS OU ID </code>, or <code> GCP Folder ID
            </code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization, Oracle Cloud Tenancy,
            Google Cloud Organization, or AWS Organization. For example, an
            <code> AWS Org ID </code> or <code> Oracle Cloud Domain ID </code>.
    ocsfv1.5.0applicationsecurityposturefindingOs:
      title: ocsfv1.5.0applicationsecurityposturefindingOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code).<p><b>Note:</b> The two letter country code
            should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        kernel_release:
          type: string
          nullable: true
          description: >-
            The kernel release of the operating system. On Unix-based systems,
            this is determined from the <code>uname -r</code> command output,
            for example "5.15.0-122-generic".
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOs_TypeId
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingOs_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.5.0applicationsecurityposturefindingOsint:
      title: ocsfv1.5.0applicationsecurityposturefindingOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDnsAnswer
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAttack
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAutonomousSystem
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        campaign:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCampaign
          nullable: true
          description: >-
            The campaign object describes details about the campaign that was
            the source of the activity.
        category:
          type: string
          nullable: true
          description: >-
            Categorizes the threat indicator based on its functional or
            operational role.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOsint_ConfidenceId
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        creator:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: >-
            The identifier of the user, system, or organization that contributed
            the indicator.
        desc:
          type: string
          nullable: true
          description: >-
            A detailed explanation of the indicator, including its context,
            purpose, and relevance.
        detection_pattern:
          type: string
          nullable: true
          description: >-
            The specific detection pattern or signature associated with the
            indicator.
        detection_pattern_type:
          type: string
          nullable: true
          description: >-
            The detection pattern type, normalized to the caption of the
            detection_pattern_type_id value. In the case of 'Other', it is
            defined by the event source.
        detection_pattern_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOsint_DetectionPatternTypeId
          nullable: true
          description: >-
            Specifies the type of detection pattern used to identify the
            associated threat indicator.
        email:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmail
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAuth
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        expiration_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        external_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier assigned by an external system for
            cross-referencing.
        file:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile'
          nullable: true
          description: >-
            Any pertinent file information related to an indicator or OSINT
            analysis.
        intrusion_sets:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A grouping of adversarial behaviors and resources believed to be
            associated with specific threat actors or campaigns. Intrusion sets
            often encompass multiple campaigns and are used to organize related
            activities under a common label.
        kill_chain:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKillChainPhase
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Tags or keywords associated with the indicator to enhance
            searchability.
        location:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLocation
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        malware:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMalware
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        name:
          type: string
          nullable: true
          description: >-
            The <code>name</code> is a pointer/reference to an attribute within
            the OCSF event data. For example: file.name.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Provides a reference to an external source of information related to
            the CTI being represented. This may include a URL, a document, or
            some other type of reference that provides additional context or
            information about the CTI.
        related_analytics:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAnalytic
          nullable: true
          description: Any analytics related to an indicator or OSINT analysis.
        reputation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingReputation
          nullable: true
          description: >-
            Related reputational analysis from third-party engines and analysts
            for a given indicator or OSINT analysis.
        risk_score:
          type: integer
          nullable: true
          description: A numerical representation of the threat indicator’s risk level.
        script:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingScript
          nullable: true
          description: >-
            Any pertinent script information related to an indicator or OSINT
            analysis.
        severity:
          type: string
          nullable: true
          description: >-
            Represents the severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        severity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOsint_SeverityId
          nullable: true
          description: >-
            The normalized severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        signatures:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDigitalSignature
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        subnet:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSubnet
          nullable: true
          description: A CIDR or network block related to an indicator or OSINT analysis.
        threat_actor:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingThreatActor
          nullable: true
          description: >-
            A threat actor is an individual or group that conducts malicious
            cyber activities, often with financial, political, or ideological
            motives.
        tlp:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOsint_Tlp
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOsint_TypeId
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the OSINT object.
        uploaded_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        uploaded_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingVulnerability
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingWhois
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.5.0applicationsecurityposturefindingOsint_ConfidenceId:
      title: ocsfv1.5.0applicationsecurityposturefindingOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingOsint_DetectionPatternTypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingOsint_DetectionPatternTypeId
      type: integer
      description: >-
        OsintDetectionPatternTypeId is an enum, and the following values are
        allowed.

        0 - Unknown: The type is not mapped.

        1 - STIX

        2 - PCRE

        3 - SIGMA

        4 - Snort

        5 - Suricata

        6 - YARA

        99 - Other: The detection pattern type is not mapped. See the
        <code>detection_pattern_type</code> attribute, which contains a data
        source specific value.
    ocsfv1.5.0applicationsecurityposturefindingOsint_SeverityId:
      title: ocsfv1.5.0applicationsecurityposturefindingOsint_SeverityId
      type: integer
      description: >-
        OsintSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingOsint_Tlp:
      title: ocsfv1.5.0applicationsecurityposturefindingOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.

        WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably,
        TLP:WHITE is the most up to date (as of TLP 2.0) usage.
    ocsfv1.5.0applicationsecurityposturefindingOsint_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP,
        VHASH, etc. generated from a file, malware sample, request header, or
        otherwise used to identify a pertinent artifact.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        11 - File: A file or metadata about a file.

        12 - RegistryKey: A Windows Registry Key.

        13 - RegistryValue: A Windows Registry Value.

        14 - CommandLine: A partial or full Command Line used to invoke scripts
        or other remote commands.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.5.0applicationsecurityposturefindingPackage:
      title: ocsfv1.5.0applicationsecurityposturefindingPackage
      type: object
      description: The Software Package object describes details about a software package.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPackage_TypeId
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.5.0applicationsecurityposturefindingPackage_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingPolicy:
      title: ocsfv1.5.0applicationsecurityposturefindingPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        data:
          nullable: true
          description: >-
            Additional data about the policy such as the underlying JSON policy
            itself or other details.
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: 'The policy name. For example: <code>IAM Policy</code>.'
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.5.0applicationsecurityposturefindingProcess:
      title: ocsfv1.5.0applicationsecurityposturefindingProcess
      type: object
      description: The Process object describes a running instance of a launched program.
      properties:
        ancestry:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProcessEntity
          nullable: true
          description: >-
            An array of Process Entities describing the extended parentage of
            this process object. Direct parent information sould be expressed
            through the <code>parent_process</code> attribute. The first array
            element is the direct parent of this process object. Subsequent list
            elements go up the process parentage hierarchy. That is, the array
            is sorted from newest to oldest process. It is recommended to only
            populate this field for the top-level process object.
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingContainer
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        environment_variables:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEnvironmentVariable
          nullable: true
          description: Environment variables associated with the process.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile'
          nullable: true
          description: The process file object.
        group:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFilePath
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProcessName
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the top-level process object, to prevent
            deep nesting. Additional ancestry information can be supplied in the
            <code>ancestry</code> attribute.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSession
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The Identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: The user under which this process is running.
        working_directory:
          type: string
          nullable: true
          description: The working directory of a process.
        xattributes:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObject
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.5.0applicationsecurityposturefindingProcess_IntegrityId:
      title: ocsfv1.5.0applicationsecurityposturefindingProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingProcessEntity:
      title: ocsfv1.5.0applicationsecurityposturefindingProcessEntity
      type: object
      description: >-
        The Process Entity object provides critical fields for referencing a
        process.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        name:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProcessName
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
    ocsfv1.5.0applicationsecurityposturefindingProduct:
      title: ocsfv1.5.0applicationsecurityposturefindingProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFeature
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.5.0applicationsecurityposturefindingRelatedEvent:
      title: ocsfv1.5.0applicationsecurityposturefindingRelatedEvent
      type: object
      description: >-
        The Related Event object describes an event or another finding related
        to a finding. It may or may not be an OCSF event.
      properties:
        attacks:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAttack
          nullable: true
          description: >-
            An array of MITRE ATT&amp;CK® objects describing identified tactics,
            techniques &amp; sub-techniques. The objects are compatible with
            MITRE ATLAS™ tactics, techniques &amp; sub-techniques.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that activity in the same logical group
            occurred, as reported by the related Finding.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the related event/finding was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the related event/finding was created.
        desc:
          type: string
          nullable: true
          description: A description of the related event/finding.
        first_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed.<br>It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was first observed. e.g. The time when a
            vulnerability was first observed.<br />It can differ from the
            <code>created_time</code> timestamp, which reflects the time this
            finding was created.
        kill_chain:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKillChainPhase
          nullable: true
          description: >-
            The <a target="_blank"
            href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
            Kill Chain®</a> provides a detailed description of each phase and
            its associated activities within the broader context of a cyber
            attack.
        last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed.<br>It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the finding was most recently observed. e.g. The time
            when a vulnerability was most recently observed.<br />It can differ
            from the <code>modified_time</code> timestamp, which reflects the
            time this finding was last modified.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the related event/finding was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the related event/finding was last modified.
        observables:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingObservable
          nullable: true
          description: The observables associated with the event or a finding.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: Details about the product that reported the related event/finding.
        product_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the product that reported the related
            event.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            <code>severity_id</code> value. In the case of 'Other', it is
            defined by the source.
        severity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRelatedEvent_SeverityId
          nullable: true
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated with the
            related event/finding.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the related event/finding.
        traits:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTrait
          nullable: true
          description: >-
            The list of key traits or characteristics extracted from the related
            event/finding that influenced or contributed to the overall
            finding's outcome.
        type:
          type: string
          nullable: true
          description: >-
            The type of the related event/finding.<p></p>Populate if the related
            event/finding is <code>NOT</code> in OCSF. If it is in OCSF, then
            utilize <code>type_name, type_uid</code> instead.
        type_name:
          type: string
          nullable: true
          description: >-
            The type of the related OCSF event, as defined by
            <code>type_uid</code>.<p>For example: <code>Process Activity:
            Launch.</code></p>Populate if the related event/finding is in OCSF.
        type_uid:
          type: integer
          nullable: true
          description: >-
            The unique identifier of the related OCSF event type. <p>For
            example: <code>100701.</code></p>Populate if the related
            event/finding is in OCSF.
        uid:
          type: string
          description: >-
            The unique identifier of the related event/finding.<p></p> If the
            related event/finding is in OCSF, then this value must be equal to
            <code>metadata.uid</code> in the corresponding event.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingRelatedEvent_SeverityId:
      title: ocsfv1.5.0applicationsecurityposturefindingRelatedEvent_SeverityId
      type: integer
      description: >-
        RelatedEventSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingRemediation:
      title: ocsfv1.5.0applicationsecurityposturefindingRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        cis_controls:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCisControl
          nullable: true
          description: >-
            An array of Center for Internet Security (CIS) Controls that can be
            optionally mapped to provide additional remediation details.
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKbArticle
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.5.0applicationsecurityposturefindingReputation:
      title: ocsfv1.5.0applicationsecurityposturefindingReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingReputation_ScoreId
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.5.0applicationsecurityposturefindingReputation_ScoreId:
      title: ocsfv1.5.0applicationsecurityposturefindingReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingRequest:
      title: ocsfv1.5.0applicationsecurityposturefindingRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingContainer
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api request.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.5.0applicationsecurityposturefindingResourceDetails:
      title: ocsfv1.5.0applicationsecurityposturefindingResourceDetails
      type: object
      description: >-
        The Resource Details object describes details about resources that were
        affected by the activity/event.
      properties:
        agent_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAgent
          nullable: true
          description: >-
            A list of agent objects associated with a device, endpoint, or
            resource.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        criticality:
          type: string
          nullable: true
          description: The criticality of the resource as defined by the event source.
        data:
          nullable: true
          description: Additional data describing the resource.
        group:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: The name of the related resource group.
        ip:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingIPAddress
          nullable: true
          description: The IP address associated with the resource.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels/tags associated to a resource.
        last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the resource was last observed or reported.
        mac:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingMACAddress
          nullable: true
          description: The MAC address associated with the resource.
        name:
          type: string
          nullable: true
          description: The name of the resource.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful when similar entities exist that you need to
            keep separate.
        os_type:
          type: string
          nullable: true
          description: The type of operating system running on the resource.
        owner:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser'
          nullable: true
          description: The identity of the service or user account that owns the resource.
        region:
          type: string
          nullable: true
          description: The cloud region of the resource.
        type:
          type: string
          nullable: true
          description: The resource type as defined by the event source.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the resource.
        version:
          type: string
          nullable: true
          description: The version of the resource. For example 1.2.3.
    ocsfv1.5.0applicationsecurityposturefindingResponse:
      title: ocsfv1.5.0applicationsecurityposturefindingResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingContainer
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api response.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.5.0applicationsecurityposturefindingRule:
      title: ocsfv1.5.0applicationsecurityposturefindingRule
      type: object
      description: >-
        The Rule object describes characteristics of a rule associated with a
        policy or an event.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.5.0applicationsecurityposturefindingSan:
      title: ocsfv1.5.0applicationsecurityposturefindingSan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.5.0applicationsecurityposturefindingSbom:
      title: ocsfv1.5.0applicationsecurityposturefindingSbom
      type: object
      description: >-
        The Software Bill of Materials object describes characteristics of a
        generated SBOM.
      properties:
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the SBOM was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the SBOM was created.
        package:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPackage
          description: >-
            The software package or library that is being discovered or
            inventoried by an SBOM.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: >-
            Details about the upstream product that generated the SBOM e.g.
            <code>cdxgen</code> or <code>Syft</code>.
        software_components:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent
          description: The list of software components used in the software package.
        type:
          type: string
          nullable: true
          description: >-
            The type of SBOM, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSbom_TypeId
          nullable: true
          description: The type of SBOM.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the SBOM or the SBOM generation by a source
            tool, such as the SPDX <code>metadata.component.bom-ref</code>.
        version:
          type: string
          nullable: true
          description: >-
            The specification (spec) version of the particular SBOM, e.g.,
            <code>1.6</code>.
      required:
        - package
        - software_components
    ocsfv1.5.0applicationsecurityposturefindingSbom_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingSbom_TypeId
      type: integer
      description: >-
        SbomTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - SPDX: System Package Data Exchange (SPDX®) is an open standard
        capable of representing systems with software components in as SBOMs
        (Software Bill of Materials) and other AI, data and security references
        supporting a range of risk management use cases. The SPDX specification
        is a freely available international open standard (ISO/IEC 5692:2021).

        2 - CycloneDX: CycloneDX is an International Standard for Bill of
        Materials (ECMA-424).

        3 - SWID: The International Organization for Standardization (ISO) and
        the International Electrotechnical Commission (IEC) publishes, ISO/IEC
        19770-2, a standard for software identification (SWID) tags that defines
        a structured metadata format for describing a software product. A SWID
        tag document is composed of a structured set of data elements that
        identify the software product

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingScim:
      title: ocsfv1.5.0applicationsecurityposturefindingScim
      type: object
      description: >-
        The System for Cross-domain Identity Management (SCIM) Configuration
        object provides a structured set of attributes related to SCIM protocols
        used for identity provisioning and management across cloud-based
        platforms. It standardizes user and group provisioning details, enabling
        identity synchronization and lifecycle management with compatible
        Identity Providers (IdPs) and applications. SCIM is defined in <a
        target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingScim_AuthProtocolId
          nullable: true
          description: >-
            The normalized identifier of the authorization protocol used by the
            SCIM resource.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: When the SCIM resource was added to the service provider.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SCIM resource was added to the service provider.
        error_message:
          type: string
          nullable: true
          description: Message or code associated with the last encountered error.
        is_group_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            groups, automatically or otherwise.
        is_user_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            users, automatically or otherwise.
        last_run_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        name:
          type: string
          nullable: true
          description: The name of the SCIM resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SCIM resource. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        rate_limit:
          type: integer
          nullable: true
          description: >-
            Maximum number of requests allowed by the SCIM resource within a
            specified time frame to avoid throttling.
        scim_group_schema:
          nullable: true
          description: >-
            SCIM provides a schema for representing groups, identified using the
            following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:Group</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            This attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource.
        scim_user_schema:
          nullable: true
          description: >-
            SCIM provides a resource type for user resources. The core schema
            for user is identified using the following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:User</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            his attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource. This object is inclusive of both the
            basic and Enterprise User Schema Extension.
        state:
          type: string
          nullable: true
          description: >-
            The provisioning state of the SCIM resource, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingScim_StateId
          nullable: true
          description: >-
            The normalized state ID of the SCIM resource to reflect its
            activation status.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for a SCIM resource as defined by the service
            provider.
        uid_alt:
          type: string
          nullable: true
          description: >-
            A String that is an identifier for the resource as defined by the
            provisioning client. The <code>externalId</code> may simplify
            identification of a resource between the provisioning client and the
            service provider by allowing the client to use a filter to locate
            the resource with an identifier from the provisioning domain,
            obviating the need to store a local mapping between the provisioning
            domain's identifier of the resource and the identifier used by the
            service provider.
        url_string:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The primary URL for SCIM API requests.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SCIM. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
        version:
          type: string
          nullable: true
          description: SCIM protocol version supported e.g., <code>SCIM 2.0</code>.
    ocsfv1.5.0applicationsecurityposturefindingScim_AuthProtocolId:
      title: ocsfv1.5.0applicationsecurityposturefindingScim_AuthProtocolId
      type: integer
      description: >-
        ScimAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingScim_StateId:
      title: ocsfv1.5.0applicationsecurityposturefindingScim_StateId
      type: integer
      description: >-
        ScimStateId is an enum, and the following values are allowed.

        0 - Unknown: The provisioning state of the SCIM resource is unknown.

        1 - Pending: The SCIM resource is Pending activation or creation.

        2 - Active: The SCIM resource is in an Active state, or otherwise
        enabled.

        3 - Failed: The SCIM resource is in a Failed state.

        4 - Deleted: The SCIM resource is in a Deleted state, or otherwise
        disabled.

        99 - Other: The provisioning state of the SCIM resource is not mapped.
        See the <code>state</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingScript:
      title: ocsfv1.5.0applicationsecurityposturefindingScript
      type: object
      description: >-
        The Script object describes a script or command that can be executed by
        a shell, script engine, or interpreter. Examples include Bash,
        JavsScript, PowerShell, Python, VBScript, etc. Note that the term
        <em>script</em> here denotes not only a script contained within a file
        but also a script or command typed interactively by a user, supplied on
        the command line, or provided by some other file-less mechanism.
      properties:
        file:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFile'
          nullable: true
          description: >-
            Present if this script is associated with a file. Not present in the
            case of a file-less script.
        hashes:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            An array of the script's cryptographic hashes. Note that these
            hashes are calculated on the script in its original encoding, and
            not on the normalized UTF-8 encoding found in the
            <code>script_content</code> attribute.
        name:
          type: string
          nullable: true
          description: >-
            Unique identifier for the script or macro, independent of the
            containing file, used for tracking, auditing, and security analysis.
        parent_uid:
          type: string
          nullable: true
          description: >-
            This attribute relates a sub-script to a parent script having the
            matching <code>uid</code> attribute. In the case of PowerShell,
            sub-script execution can be identified by matching the activity
            correlation ID of the raw ETW events provided by the OS.
        script_content:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLongString
          description: >-
            The script content, normalized to UTF-8 encoding irrespective of its
            original encoding. When emitting this attribute, it may be
            appropriate to truncate large scripts. When consuming this
            attribute, large scripts should be anticipated.
        type:
          type: string
          nullable: true
          description: >-
            The script type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the event source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingScript_TypeId
          description: The normalized script type ID.
        uid:
          type: string
          nullable: true
          description: >-
            Some script engines assign a unique ID to each individual execution
            of a given script. This attribute captures that unique ID. In the
            case of PowerShell, the unique ID corresponds to the
            <code>ScriptBlockId</code> in the raw ETW events provided by the OS.
      required:
        - script_content
        - type_id
    ocsfv1.5.0applicationsecurityposturefindingScript_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingScript_TypeId
      type: integer
      description: >-
        ScriptTypeId is an enum, and the following values are allowed.

        0 - Unknown: The script type is unknown.

        1 - WindowsCommandPrompt

        2 - PowerShell

        3 - Python

        4 - JavaScript

        5 - VBScript

        6 - UnixShell

        7 - VBA

        99 - Other: The script type is not mapped. See the <code>type</code>
        attribute which contains an event source specific value.
    ocsfv1.5.0applicationsecurityposturefindingService:
      title: ocsfv1.5.0applicationsecurityposturefindingService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        tags:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKeyValueObject
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.5.0applicationsecurityposturefindingSession:
      title: ocsfv1.5.0applicationsecurityposturefindingSession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent:
      title: ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent
      type: object
      description: >-
        The Software Component object describes characteristics of a software
        component within a software package.
      properties:
        author:
          type: string
          nullable: true
          description: The author(s) who published the software component.
        hash:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingFingerprint
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component.
        license:
          type: string
          nullable: true
          description: The software license applied to this component.
        name:
          type: string
          description: The software component name.
        purl:
          type: string
          nullable: true
          description: >-
            The Package URL (PURL) to identify the software component. This is a
            URL that uniquely identifies the component, including the
            component's name, version, and type. The URL is used to locate and
            retrieve the component's metadata and content.
        related_component:
          type: string
          nullable: true
          description: >-
            The package URL (PURL) of the component that this software component
            has a relationship with.
        relationship:
          type: string
          nullable: true
          description: >-
            The relationship between two software components, normalized to the
            caption of the <code>relationship_id</code> value. In the case of
            'Other', it is defined by the source.
        relationship_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent_RelationshipId
          nullable: true
          description: >-
            The normalized identifier of the relationship between two software
            components.
        type:
          type: string
          nullable: true
          description: >-
            The type of software component, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent_TypeId
          nullable: true
          description: The type of software component.
        version:
          type: string
          description: The software component version.
      required:
        - name
        - version
    ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent_RelationshipId:
      title: >-
        ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent_RelationshipId
      type: integer
      description: >-
        SoftwareComponentRelationshipId is an enum, and the following values are
        allowed.

        0 - Unknown: The relationship is unknown.

        1 - DependsOn: The component is a dependency of another component. Can
        be used to define both direct and transitive dependencies.

        99 - Other: The relationship is not mapped. See the
        <code>relationship</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingSoftwareComponent_TypeId
      type: integer
      description: >-
        SoftwareComponentTypeId is an enum, and the following values are
        allowed.

        0 - Unknown: The type is unknown.

        1 - Framework: A software framework.

        2 - Library: A software library.

        3 - OperatingSystem: An operating system. Useful for SBOMs of container
        images.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingSso:
      title: ocsfv1.5.0applicationsecurityposturefindingSso
      type: object
      description: >-
        The Single Sign-On (SSO) object provides a structure for normalizing SSO
        attributes, configuration, and/or settings from Identity Providers.
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSso_AuthProtocolId
          nullable: true
          description: >-
            The normalized identifier of the authentication protocol used by the
            SSO resource.
        certificate:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCertificate
          nullable: true
          description: >-
            Digital Signature associated with the SSO resource, e.g., SAML X.509
            certificate details.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: When the SSO resource was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SSO resource was created.
        duration_mins:
          type: integer
          nullable: true
          description: >-
            The duration (in minutes) for an SSO session, after which
            re-authentication is required.
        idle_timeout:
          type: integer
          nullable: true
          description: >-
            Duration (in minutes) of allowed inactivity before Single Sign-On
            (SSO) session expiration.
        login_endpoint:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: URL for initiating an SSO login request.
        logout_endpoint:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            URL for initiating an SSO logout request, allowing sessions to be
            terminated across applications.
        metadata_endpoint:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            URL where metadata about the SSO configuration is available (e.g.,
            for SAML configurations).
        modified_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The most recent time when the SSO resource was updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent time when the SSO resource was updated.
        name:
          type: string
          nullable: true
          description: The name of the SSO resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SSO resource. E.g., <code>SAML</code>
            or <code>OIDC</code>.
        scopes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Scopes define the specific permissions or actions that the client is
            allowed to perform on behalf of the user. Each scope represents a
            different set of permissions, and the user can selectively grant or
            deny access to specific scopes during the authorization process.
        uid:
          type: string
          nullable: true
          description: A unique identifier for a SSO resource.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SSO. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
    ocsfv1.5.0applicationsecurityposturefindingSso_AuthProtocolId:
      title: ocsfv1.5.0applicationsecurityposturefindingSso_AuthProtocolId
      type: integer
      description: >-
        SsoAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingSubTechnique:
      title: ocsfv1.5.0applicationsecurityposturefindingSubTechnique
      type: object
      description: >-
        The MITRE Sub-technique object describes the ATT&amp;CK® or ATLAS™
        Sub-technique ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub-technique. For example: <code>Scanning IP
            Blocks</code> or <code>User Execution: Unsafe ML Artifacts</code>.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The versioned permalink of the attack sub-technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub-technique. For example:
            <code>T1595.001</code> or <code>AML.T0011.000</code>.
    ocsfv1.5.0applicationsecurityposturefindingTactic:
      title: ocsfv1.5.0applicationsecurityposturefindingTactic
      type: object
      description: >-
        The MITRE Tactic object describes the ATT&amp;CK® or ATLAS™ Tactic ID
        and/or name that is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The Tactic name that is associated with the attack technique. For
            example: <code>Reconnaissance</code> or <code>ML Model
            Access</code>.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The versioned permalink of the Tactic. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Tactic ID that is associated with the attack technique. For
            example: <code>TA0043</code>, or <code>AML.TA0000</code>.
    ocsfv1.5.0applicationsecurityposturefindingTechnique:
      title: ocsfv1.5.0applicationsecurityposturefindingTechnique
      type: object
      description: >-
        The MITRE Technique object describes the ATT&amp;CK® or ATLAS™ Technique
        ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique. For example: <code>Active
            Scanning</code> or <code>AI Model Inference API Access</code>.
        src_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The versioned permalink of the attack technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique. For example:
            <code>T1595</code> or <code>AML.T0040</code>.
    ocsfv1.5.0applicationsecurityposturefindingThreatActor:
      title: ocsfv1.5.0applicationsecurityposturefindingThreatActor
      type: object
      description: Threat actor is responsible for the observed malicious activity.
      properties:
        name:
          type: string
          description: The name of the threat actor.
        type:
          type: string
          nullable: true
          description: >-
            The classification of the threat actor based on their motivations,
            capabilities, or affiliations. Common types include nation-state
            actors, cybercriminal groups, hacktivists, or insider threats.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingThreatActor_TypeId
          nullable: true
          description: The normalized datastore resource type identifier.
      required:
        - name
    ocsfv1.5.0applicationsecurityposturefindingThreatActor_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingThreatActor_TypeId
      type: integer
      description: |-
        ThreatActorTypeId is an enum, and the following values are allowed.
        0 - Unknown: The threat actor type is unknown.
        1 - state
        2 - Cybercriminal
        3 - Hacktivists
        4 - Insider
        99 - Other: The threat actor type is not mapped.
    ocsfv1.5.0applicationsecurityposturefindingTimespan:
      title: ocsfv1.5.0applicationsecurityposturefindingTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may be populated since each member is of integral type. In
        that case <code>type_id</code> if present should be set to
        <code>Other.</code><p>A timespan may also be defined by its time
        interval boundaries, <code>start_time</code> and
        <code>end_time</code>.</p>
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        end_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        start_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The start time or beginning of the timespan's interval.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The start time or beginning of the timespan's interval.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimespan_TypeId
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.5.0applicationsecurityposturefindingTimespan_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        9 - TimeInterval: The <code>start_time</code> and <code>end_time</code>
        should be set.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingTrait:
      title: ocsfv1.5.0applicationsecurityposturefindingTrait
      type: object
      description: >-
        Describes a characteristic or feature of an entity that was observed.
        For example, this object can be used to represent specific
        characteristics derived from events or findings that can be surfaced as
        distinguishing traits of the entity in question.
      properties:
        category:
          type: string
          nullable: true
          description: The high-level grouping or classification this trait belongs to.
        name:
          type: string
          nullable: true
          description: The name of the trait.
        type:
          type: string
          nullable: true
          description: >-
            The type of the trait. For example, this can be used to indicate if
            the trait acts as a contributing factor (increases risk/severity) or
            a mitigating factor (decreases risk/severity), in the context of the
            related finding.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the trait.
        values:
          type: array
          items:
            type: string
          nullable: true
          description: The values of the trait.
    ocsfv1.5.0applicationsecurityposturefindingTransformationInfo:
      title: ocsfv1.5.0applicationsecurityposturefindingTransformationInfo
      type: object
      description: >-
        The transformation_info object represents the mapping or transformation
        used.
      properties:
        lang:
          type: string
          nullable: true
          description: The transformation language used to transform the data.
        name:
          type: string
          nullable: true
          description: The name of the transformation or mapping.
        product:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingProduct
          nullable: true
          description: The product or instance used to make the transformation
        time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: Time of the transformation.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: Time of the transformation.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the mapping or transformation.
        url_string:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The Uniform Resource Locator String where the mapping or
            transformation exists.
    ocsfv1.5.0applicationsecurityposturefindingUrl:
      title: ocsfv1.5.0applicationsecurityposturefindingUrl
      type: object
      description: >-
        The Uniform Resource Locator (URL) object describes the characteristics
        of a URL.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUrl_CategoryIds
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingHostname
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.5.0applicationsecurityposturefindingUrl_CategoryIds:
      title: ocsfv1.5.0applicationsecurityposturefindingUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.5.0applicationsecurityposturefindingUser:
      title: ocsfv1.5.0applicationsecurityposturefindingUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal.
      properties:
        account:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAccount
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        display_name:
          type: string
          nullable: true
          description: The display name of the user, as reported by the product.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The user's primary email address.
        forward_addr:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The user's forwarding email address.
        full_name:
          type: string
          nullable: true
          description: The full name of the user, as reported by the product.
        groups:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingGroup
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingLdapPerson
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser_MfaStatusId
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUserName
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingOrganization
          nullable: true
          description: Organization and org unit related to the user.
        phone_number:
          type: string
          nullable: true
          description: The telephone number of the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser_RiskLevelId
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser_TypeId
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingUser_UserStatusId
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.5.0applicationsecurityposturefindingUser_MfaStatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingUser_RiskLevelId:
      title: ocsfv1.5.0applicationsecurityposturefindingUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingUser_TypeId:
      title: ocsfv1.5.0applicationsecurityposturefindingUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.5.0applicationsecurityposturefindingUser_UserStatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingVendorAttributes:
      title: ocsfv1.5.0applicationsecurityposturefindingVendorAttributes
      type: object
      description: >-
        The Vendor Attributes object can be used to represent values of
        attributes populated by the Vendor/Finding Provider. It can help
        distinguish between the vendor-prodvided values and consumer-updated
        values, of key attributes like <code>severity_id</code>.<br />The
        original finding producer should not populate this object. It should be
        populated by consuming systems that support data mutability.
      properties:
        severity:
          type: string
          nullable: true
          description: >-
            The finding severity, as reported by the Vendor (Finding Provider).
            The value should be normalized to the caption of the
            <code>severity_id</code> value. In the case of 'Other', it is
            defined by the source.
        severity_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingVendorAttributes_SeverityId
          nullable: true
          description: >-
            The finding severity ID, as reported by the Vendor (Finding
            Provider).
    ocsfv1.5.0applicationsecurityposturefindingVendorAttributes_SeverityId:
      title: ocsfv1.5.0applicationsecurityposturefindingVendorAttributes_SeverityId
      type: integer
      description: >-
        VendorAttributesSeverityId is an enum, and the following values are
        allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.5.0applicationsecurityposturefindingVulnerability:
      title: ocsfv1.5.0applicationsecurityposturefindingVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        advisory:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAdvisory
          nullable: true
          description: >-
            Detail about the security advisory, that is used to publicly
            disclose cybersecurity vulnerabilities by a vendor.
        affected_code:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAffectedCode
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAffectedPackage
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        category:
          type: string
          nullable: true
          description: >-
            The category of a vulnerability or weakness, as reported by the
            source tool, such as <code>Container Security</code> or <code>Open
            Source Security</code>.
        cve:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCve'
          nullable: true
          description: >-
            Describes the Common Vulnerabilities and Exposures <a
            target='_blank' href='https://cve.mitre.org/'>(CVE)</a> details
            related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.5.0applicationsecurityposturefindingCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target='_blank'
            href='https://cwe.mitre.org/'>(CWE)</a> details related to the
            vulnerability.
        dependency_chain:
          type: string
          nullable: true
          description: >-
            Information about the chain of dependencies related to the issue as
            reported by an Application Security or Vulnerability Management
            tool. E.g., <code>serverless-offline -&gt; @serverless/utils -&gt;
            memoizee -&gt; es5-ext</code>.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        exploit_last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_ref_url:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingURLString
          nullable: true
          description: The URL of the exploit code or Proof-of-Concept (PoC).
        exploit_requirement:
          type: string
          nullable: true
          description: >-
            The requirement description related to any constraints around
            exploit execution.
        exploit_type:
          type: string
          nullable: true
          description: >-
            The categorization or type of Exploit. E.g., <code>Network</code> or
            <code>Physical</code>.
        first_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        fix_coverage:
          type: string
          nullable: true
          description: >-
            The fix coverage, normalized to the caption of the
            <code>fix_coverage_id</code> value.
        fix_coverage_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingVulnerability_FixCoverageId
          nullable: true
          description: >-
            The normalized identifier for fix coverage, applicable to this
            vulnerability. Typically useful, when there are multiple affected
            packages but only a subset have available fixes.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingKbArticle
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingPackage
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            List of vulnerability IDs (e.g. CVE ID) that are related to this
            vulnerability.
        remediation:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingRemediation
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.5.0applicationsecurityposturefindingVulnerability_FixCoverageId:
      title: ocsfv1.5.0applicationsecurityposturefindingVulnerability_FixCoverageId
      type: integer
      description: >-
        VulnerabilityFixCoverageId is an enum, and the following values are
        allowed.

        0 - Unknown: The fix coverage is unknown.

        1 - Complete: All affected packages and components have available fixes
        or patches to remediate the vulnerability.

        2 - Partial: Only some of the affected packages and components have
        available fixes or patches, while others remain vulnerable.

        3 - None: No fixes or patches are currently available for any of the
        affected packages and components.

        99 - Other: The fix coverage is not mapped. See the
        <code>fix_coverage</code> attribute, which contains a data source
        specific value.
    ocsfv1.5.0applicationsecurityposturefindingWhois:
      title: ocsfv1.5.0applicationsecurityposturefindingWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingAutonomousSystem
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The domain name corresponding to the WHOIS record.
        domain_contacts:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingDomainContact
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingEmailAddress
          nullable: true
          description: The email address for the registrar's abuse contact
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        last_seen_time:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingTimestamp
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: >-
            #/components/schemas/ocsfv1.5.0applicationsecurityposturefindingSubnet
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.5.0applicationsecurityposturefindingWhois_DnssecStatusId:
      title: ocsfv1.5.0applicationsecurityposturefindingWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityEmailAddress:
      title: ocsfv1.6.0emailactivityEmailAddress
      type: string
      description: Email address. For example:<br /><code>john_doe@example.com</code>.
    ocsfv1.6.0emailactivityFileName:
      title: ocsfv1.6.0emailactivityFileName
      type: string
      description: File name. For example:<br /><code>text-file.txt</code>.
    ocsfv1.6.0emailactivityFilePath:
      title: ocsfv1.6.0emailactivityFilePath
      type: string
      description: >-
        The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.
    ocsfv1.6.0emailactivityHash:
      title: ocsfv1.6.0emailactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example:<br /> MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.6.0emailactivityHostname:
      title: ocsfv1.6.0emailactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. It may
        be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>
    ocsfv1.6.0emailactivityIPAddress:
      title: ocsfv1.6.0emailactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.6.0emailactivityMACAddress:
      title: ocsfv1.6.0emailactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.
    ocsfv1.6.0emailactivityPort:
      title: ocsfv1.6.0emailactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example:<br /><code>80</code>,<br
        /><code>22</code>.
    ocsfv1.6.0emailactivityProcessName:
      title: ocsfv1.6.0emailactivityProcessName
      type: string
      description: Process name. For example:<br /><code>Notepad</code>.
    ocsfv1.6.0emailactivitySubnet:
      title: ocsfv1.6.0emailactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>
    ocsfv1.6.0emailactivityTimestamp:
      title: ocsfv1.6.0emailactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example:<br /><code>1618524549901</code>.
    ocsfv1.6.0emailactivityURLString:
      title: ocsfv1.6.0emailactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.6.0emailactivityUserName:
      title: ocsfv1.6.0emailactivityUserName
      type: string
      description: User name. For example:<br /><code>john_doe</code>.
    ocsfv1.6.0emailactivityActionId:
      title: ocsfv1.6.0emailactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Custom
        Action', 'Challenge'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        3 - Observed: The activity was observed, but neither explicitly allowed
        nor denied. This is common with IDS and EDR controls that report
        additional information on observed behavior such as TTPs. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Logged', 'Alert', 'Detected',
        'Count', etc.

        4 - Modified: The activity was modified, adjusted, or corrected. The
        <code>disposition_id</code> attribute should be set appropriately, for
        example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.

        99 - Other: The action is not mapped. See the <code>action</code>
        attribute which contains a data source specific value.
    ocsfv1.6.0emailactivityActivityId:
      title: ocsfv1.6.0emailactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Send

        2 - Receive

        3 - Scan: Email being scanned (example: security scanning)

        4 - Trace: Follow an email message as it travels through an
        organization. The <code>message_trace_uid</code> should be populated
        when selected.

        5 - MTARelay: Email processed by an MTA, typically combining send,
        receive, and scan operations into a single activity.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityCategoryUid:
      title: ocsfv1.6.0emailactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        4 - NetworkActivity: Network Activity events.
    ocsfv1.6.0emailactivityClassUid:
      title: ocsfv1.6.0emailactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        4009 - EmailActivity: Email Activity events report SMTP protocol and
        email activities including those with embedded URLs and files. See the
        <code>Email</code> object for details.
    ocsfv1.6.0emailactivityConfidenceId:
      title: ocsfv1.6.0emailactivityConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityDirectionId:
      title: ocsfv1.6.0emailactivityDirectionId
      type: integer
      description: >-
        DirectionId is an enum, and the following values are allowed.

        0 - Unknown: The email direction is unknown.

        1 - Inbound: Email Inbound, from the Internet or outside network
        destined for an entity inside network.

        2 - Outbound: Email Outbound, from inside the network destined for an
        entity outside network.

        3 - Internal: Email Internal, from inside the network destined for an
        entity inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityDispositionId:
      title: ocsfv1.6.0emailactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityEmailActivity:
      title: ocsfv1.6.0emailactivityEmailActivity
      type: object
      description: >-
        Email Activity events report SMTP protocol and email activities
        including those with embedded URLs and files. See the <code>Email</code>
        object for details.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. An unknown action may still correspond
            to a known disposition. Refer to <code>disposition_id</code> for the
            outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity. Note that this is not the threat
            actor of a campaign but may be part of a campaign.
        api:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAttack'
          nullable: true
          description: >-
            An array of MITRE ATT&amp;CK® objects describing identified tactics,
            techniques &amp; sub-techniques. The objects are compatible with
            MITRE ATLAS™ tactics, techniques &amp; sub-techniques.
        attempt:
          type: integer
          nullable: true
          description: The attempt number for attempting to deliver the email.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        banner:
          type: string
          nullable: true
          description: >-
            The initial connection response that a messaging server receives
            after it connects to an email server.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Network Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        command:
          type: string
          nullable: true
          description: >-
            The command issued by the initiator (client), such as SMTP HELO or
            EHLO.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the email, as defined by the
            <code>direction_id</code> value.
        direction_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDirectionId'
          description: >-
            <p>The direction of the email relative to the scanning host or
            organization.</p>Email scanned at an internet gateway might be
            characterized as inbound to the organization from the Internet,
            outbound from the organization to the Internet, or internal within
            the organization. Email scanned at a workstation might be
            characterized as inbound to, or outbound from the workstation.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkEndpoint'
          nullable: true
          description: The responder (server) receiving the email.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        email:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmail'
          description: The email object.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAuth'
          nullable: true
          description: The SPF, DKIM and DMARC attributes of an email.
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFirewallRule'
          nullable: true
          description: >-
            The firewall rule that pertains to the control that triggered the
            event, if applicable.
        from:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The sender address from the transmission envelope. This reflects the
            actual sending party and may differ from the 'From' header in the
            message.
        is_alert:
          type: boolean
          nullable: true
          description: >-
            Indicates that the event is considered to be an alertable signal.
            Should be set to <code>true</code> if <code>disposition_id =
            Alert</code> among other dispositions, and/or
            <code>risk_level_id</code> or <code>severity_id</code> of the event
            is elevated. Not all control events will be alertable, for example
            if <code>disposition_id = Exonerated</code> or <code>disposition_id
            = Allowed</code>.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        malware_scan_info:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMalwareScanInfo'
          nullable: true
          description: >-
            Describes details about the scan job that identified malware on the
            target system.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        message_trace_uid:
          type: string
          nullable: true
          description: >-
            The identifier that tracks a message that travels through multiple
            points of a messaging service.
        metadata:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPolicy'
          nullable: true
          description: >-
            The policy that pertains to the control that triggered the event, if
            applicable. For example the name of an anti-malware policy or an
            access control policy.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The Protocol Name specifies the email communication protocol, such
            as SMTP, IMAP, or POP3.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        raw_data_hash:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: The hash, which describes the content of the raw_data field.
        raw_data_size:
          type: integer
          nullable: true
          description: >-
            The size of the raw data which was transformed into an OCSF event,
            in bytes.
        risk_details:
          type: string
          nullable: true
          description: Describes the risk associated with the finding.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityRiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            <code>severity_id</code> value. In the case of 'Other', it is
            defined by the source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        smtp_hello:
          type: string
          nullable: true
          description: >-
            The value of the SMTP HELO or EHLO command sent by the initiator
            (client).
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkEndpoint'
          nullable: true
          description: The initiator (client) sending the email.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The recipient address from the transmission envelope. This may
            differ from the 'To' header and represents where the message was
            actually delivered.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - direction_id
        - email
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.6.0emailactivityRiskLevelId:
      title: ocsfv1.6.0emailactivityRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivitySeverityId:
      title: ocsfv1.6.0emailactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityStatusId:
      title: ocsfv1.6.0emailactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityTypeUid:
      title: ocsfv1.6.0emailactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        400900 - Unknown

        400901 - Send

        400902 - Receive

        400903 - Scan: Email being scanned (example: security scanning)

        400904 - Trace: Follow an email message as it travels through an
        organization. The <code>message_trace_uid</code> should be populated
        when selected.

        400905 - MTARelay: Email processed by an MTA, typically combining send,
        receive, and scan operations into a single activity.

        400999 - Other
    ocsfv1.6.0emailactivityAccount:
      title: ocsfv1.6.0emailactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
        Additionally, the Account object refers to logical Cloud and
        Software-as-a-Service (SaaS) based containers such as AWS Accounts,
        Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects,
        and otherwise.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the account.
        name:
          type: string
          nullable: true
          description: >-
            The name of the account (e.g. <code> GCP Project name </code>,
            <code> Linux Account name </code> or <code> AWS Account
            name</code>).
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            account.
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the account (e.g. <code> AWS Account ID
            </code>, <code> OCID </code>, <code> GCP Project ID </code>, <code>
            Azure Subscription ID </code>, <code> Google Workspace Customer ID
            </code>, or <code> M365 Tenant UID</code>).
    ocsfv1.6.0emailactivityAccount_TypeId:
      title: ocsfv1.6.0emailactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        11 - GCPProject
        12 - OCICompartment
        13 - AzureSubscription
        14 - SalesforceAccount
        15 - GoogleWorkspace
        16 - ServicenowInstance
        17 - M365Tenant
        18 - EmailAccount
        99 - Other: The account type is not mapped.
    ocsfv1.6.0emailactivityActor:
      title: ocsfv1.6.0emailactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
        Note that Actor is not the threat actor of a campaign but may be part of
        a campaign.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.6.0emailactivityActor_ActorTypeId:
      title: ocsfv1.6.0emailactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityAdvisory:
      title: ocsfv1.6.0emailactivityAdvisory
      type: object
      description: >-
        The Advisory object represents publicly disclosed cybersecurity
        vulnerabilities defined in a Security advisory. e.g. <code> Microsoft KB
        Article</code>, <code>Apple Security Advisory</code>, or a <code>GitHub
        Security Advisory (GHSA)</code>
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The Advisory bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the Advisory.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the Advisory record was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was created.
        desc:
          type: string
          nullable: true
          description: A brief description of the Advisory Record.
        install_state:
          type: string
          nullable: true
          description: The install state of the Advisory.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAdvisory_InstallStateId'
          nullable: true
          description: The normalized install state ID of the Advisory.
        is_superseded:
          type: boolean
          nullable: true
          description: The Advisory has been replaced by another.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the Advisory record was last updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was last updated.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOs'
          nullable: true
          description: The operating system the Advisory applies to.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerabilities disclosed in the Advisory.
        related_cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityCve'
          nullable: true
          description: >-
            A list of Common Vulnerabilities and Exposures <a target="_blank"
            href="https://cve.mitre.org/">(CVE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityCwe'
          nullable: true
          description: >-
            A list of Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        size:
          type: integer
          nullable: true
          description: >-
            The size in bytes for the Advisory. Usually populated for a KB
            Article patch.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: The Advisory link from the source vendor.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the Advisory.
        uid:
          type: string
          description: >-
            The unique identifier assigned to the advisory or disclosed
            vulnerability, e.g, <code>GHSA-5mrr-rgp6-x4gr</code>.
      required:
        - uid
    ocsfv1.6.0emailactivityAdvisory_InstallStateId:
      title: ocsfv1.6.0emailactivityAdvisory_InstallStateId
      type: integer
      description: >-
        AdvisoryInstallStateId is an enum, and the following values are allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityAffectedCode:
      title: ocsfv1.6.0emailactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_column:
          type: integer
          nullable: true
          description: >-
            The column number of the last part of the assessed code identified
            as vulnerable.
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        rule:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityRule'
          nullable: true
          description: >-
            Details about the specific rule, e.g., those defined as part of a
            larger <code>policy</code>, that triggered the finding.
        start_column:
          type: integer
          nullable: true
          description: >-
            The column number of the first part of the assessed code identified
            as vulnerable.
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.6.0emailactivityAffectedPackage:
      title: ocsfv1.6.0emailactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        path:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFilePath'
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.6.0emailactivityAffectedPackage_TypeId:
      title: ocsfv1.6.0emailactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityAgent:
      title: ocsfv1.6.0emailactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.6.0emailactivityAgent_TypeId:
      title: ocsfv1.6.0emailactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityAnalytic:
      title: ocsfv1.6.0emailactivityAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The algorithm used by the underlying analytic to generate the
            finding.
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: Other analytics related to this analytic.
        state:
          type: string
          nullable: true
          description: The Analytic state.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAnalytic_StateId'
          nullable: true
          description: The Analytic state identifier.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.6.0emailactivityAnalytic_StateId:
      title: ocsfv1.6.0emailactivityAnalytic_StateId
      type: integer
      description: >-
        AnalyticStateId is an enum, and the following values are allowed.

        0 - Unknown: The state is unknown.

        1 - Active: The Analytic is active.

        2 - Suppressed: The Analytic is suppressed. For example, a user/customer
        has suppressed a particular detection signature in a security product.

        3 - Experimental: The Analytic is still under development and considered
        experimental.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityAnalytic_TypeId:
      title: ocsfv1.6.0emailactivityAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityApi:
      title: ocsfv1.6.0emailactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.6.0emailactivityAttack:
      title: ocsfv1.6.0emailactivityAttack
      type: object
      description: >-
        The MITRE ATT&amp;CK® &amp; ATLAS™ object describes the tactic,
        technique, sub-technique &amp; mitigation associated to an attack.
      properties:
        mitigation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMitigation'
          nullable: true
          description: >-
            The Mitigation object describes the MITRE ATT&CK® or ATLAS™
            Mitigation ID and/or name that is associated to an attack.
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySubTechnique'
          nullable: true
          description: >-
            The Sub-technique object describes the MITRE ATT&CK® or ATLAS™
            Sub-technique ID and/or name associated to an attack.
        tactic:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID
            and/or name that is associated to an attack.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique
            ID and/or name associated to an attack.
        version:
          type: string
          nullable: true
          description: The ATT&amp;CK® or ATLAS™ Matrix version.
    ocsfv1.6.0emailactivityAuthFactor:
      title: ocsfv1.6.0emailactivityAuthFactor
      type: object
      description: >-
        An Authentication Factor object describes a category of methods used for
        identity verification in an authentication attempt.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDevice'
          nullable: true
          description: Device used to complete an authentication request.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The email address used in an email-based authentication factor.
        factor_type:
          type: string
          nullable: true
          description: The type of authentication factor used in an authentication attempt.
        factor_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAuthFactor_FactorTypeId'
          description: The normalized identifier for the authentication factor.
        is_hotp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is an HMAC-based One-time Password
            (HOTP).
        is_totp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is a Time-based One-time Password
            (TOTP).
        phone_number:
          type: string
          nullable: true
          description: The phone number used for a telephony-based authentication request.
        provider:
          type: string
          nullable: true
          description: The name of provider for an authentication factor.
        security_questions:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The question(s) provided to user for a question-based authentication
            factor.
      required:
        - factor_type_id
    ocsfv1.6.0emailactivityAuthFactor_FactorTypeId:
      title: ocsfv1.6.0emailactivityAuthFactor_FactorTypeId
      type: integer
      description: >-
        AuthFactorFactorTypeId is an enum, and the following values are allowed.

        0 - Unknown

        1 - SMS: User receives and inputs a code sent to their mobile device via
        SMS text message.

        2 - SecurityQuestion: The user responds to a security question as part
        of a question-based authentication factor

        3 - PhoneCall: System calls the user's registered phone number and
        requires the user to answer and provide a response.

        4 - Biometric: Devices that verify identity-based on user's physical
        identifiers, such as fingerprint scanners or retina scanners.

        5 - PushNotification: Push notification is sent to user's registered
        device and requires the user to acknowledge.

        6 - HardwareToken: Physical device that generates a code to be used for
        authentication.

        7 - OTP: Application generates a one-time password (OTP) for use in
        authentication.

        8 - Email: A code or link is sent to a user's registered email address.

        9 - U2F: Typically involves a hardware token, which the user physically
        interacts with to authenticate.

        10 - WebAuthn: Web-based API that enables users to register devices as
        authentication factors.

        11 - Password: The user enters a password that they have previously
        established.

        99 - Other
    ocsfv1.6.0emailactivityAuthorization:
      title: ocsfv1.6.0emailactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.6.0emailactivityAutonomousSystem:
      title: ocsfv1.6.0emailactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.6.0emailactivityCampaign:
      title: ocsfv1.6.0emailactivityCampaign
      type: object
      description: >-
        Campaign represent organized efforts by threat actors to achieve
        malicious objectives over a period, often characterized by shared
        tactics, techniques, and procedures (TTPs).
      properties:
        name:
          type: string
          description: The name of a specific campaign associated with a cyber threat.
      required:
        - name
    ocsfv1.6.0emailactivityCertificate:
      title: ocsfv1.6.0emailactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - issuer
        - serial_number
    ocsfv1.6.0emailactivityCisControl:
      title: ocsfv1.6.0emailactivityCisControl
      type: object
      description: >-
        The CIS Control (aka Critical Security Control) object describes a
        prioritized set of actions to protect your organization and data from
        cyber-attack vectors. The <a target="_blank"
        href="https://www.cisecurity.org/controls">CIS Controls</a> are defined
        by the Center for Internet Security.
      properties:
        desc:
          type: string
          nullable: true
          description: >-
            The CIS Control description. For example: <i>Uninstall or disable
            unnecessary services on enterprise assets and software, such as an
            unused file sharing service, web application module, or service
            function.</i>
        name:
          type: string
          description: >-
            The CIS Control name. For example: <i>4.8 Uninstall or Disable
            Unnecessary Services on Enterprise Assets and Software.</i>
        version:
          type: string
          nullable: true
          description: 'The CIS Control version. For example: <i>v8</i>.'
      required:
        - name
    ocsfv1.6.0emailactivityCloud:
      title: ocsfv1.6.0emailactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud or
        Software-as-a-Service account or similar construct, such as AWS Account
        ID, regions, organizations, folders, compartments, tenants, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        org:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.6.0emailactivityContainer:
      title: ocsfv1.6.0emailactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            container.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.6.0emailactivityCve:
      title: ocsfv1.6.0emailactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> details related to the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.6.0emailactivityCvss:
      title: ocsfv1.6.0emailactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The source URL for the CVSS score. For example:
            <code>https://nvd.nist.gov/vuln/detail/CVE-2021-44228</code>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor that provided the CVSS score. For example: <code>NVD,
            REDHAT</code> etc.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.6.0emailactivityCvss_Depth:
      title: ocsfv1.6.0emailactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.6.0emailactivityCwe:
      title: ocsfv1.6.0emailactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.6.0emailactivityD3fTactic:
      title: ocsfv1.6.0emailactivityD3fTactic
      type: object
      description: >-
        The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that
        is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the defensive technique. For
            example: <code>Isolate</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the defensive tactic. For example:
            <code>https://d3fend.mitre.org/tactic/d3f:Isolate/</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the defensive tactic.
    ocsfv1.6.0emailactivityD3fTechnique:
      title: ocsfv1.6.0emailactivityD3fTechnique
      type: object
      description: >-
        The MITRE D3FEND™ Technique object describes the leaf defensive
        technique ID and/or name associated to a countermeasure.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the defensive technique. For example: <code>IO Port
            Restriction</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the defensive technique. For example:
            <code>https://d3fend.mitre.org/technique/d3f:IOPortRestriction/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the defensive technique. For example:
            <code>D3-IOPR</code>.
    ocsfv1.6.0emailactivityD3fend:
      title: ocsfv1.6.0emailactivityD3fend
      type: object
      description: >-
        The MITRE D3FEND™ object describes the tactic &amp; technique associated
        with a countermeasure.
      properties:
        d3f_tactic:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityD3fTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated with a countermeasure.
        d3f_technique:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityD3fTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated with a countermeasure.
        version:
          type: string
          nullable: true
          description: The D3FEND™ Matrix version.
    ocsfv1.6.0emailactivityDevice:
      title: ocsfv1.6.0emailactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        boot_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier of the device that changes after every reboot.
            For example, the value of
            <code>/proc/sys/kernel/random/boot_id</code> from Linux's procfs.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        eid:
          type: string
          nullable: true
          description: >-
            An Embedded Identity Document, is a unique serial number that
            identifies an eSIM-enabled device.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        iccid:
          type: string
          nullable: true
          description: >-
            The Integrated Circuit Card Identification of a mobile device.
            Typically it is a unique 18 to 22 digit number that identifies a SIM
            card.
        image:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity that is associated with
            the device.
        imei_list:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity values that are
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_backed_up:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device or resource has a backup enabled, such
            as an automated snapshot or a cloud backup. For example, this is
            indicated by the <code>cloudBackupEnabled</code> value within JAMF
            Pro mobile devices or the registration of an AWS ARN with the AWS
            Backup service.
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_mobile_account_active:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device has an active mobile account. For
            example, this is indicated by the
            <code>itunesStoreAccountActive</code> value within JAMF Pro mobile
            devices.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_shared:
          type: boolean
          nullable: true
          description: The event occurred on a shared device.
        is_supervised:
          type: boolean
          nullable: true
          description: >-
            The event occurred on a supervised device. Devices that are
            supervised are typically mobile devices managed by a Mobile Device
            Management solution and are restricted from specific behaviors such
            as Apple AirDrop.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        meid:
          type: string
          nullable: true
          description: >-
            The Mobile Equipment Identifier. It's a unique number that
            identifies a Code Division Multiple Access (CDMA) mobile device.
        model:
          type: string
          nullable: true
          description: >-
            The model of the device. For example <code>ThinkPad X1
            Carbon</code>.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkInterface'
          nullable: true
          description: >-
            The physical or virtual network interfaces that are associated with
            the device, one for each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOs'
          nullable: true
          description: The endpoint operating system.
        os_machine_uuid:
          type: string
          nullable: true
          description: >-
            The operating system assigned Machine ID. In Windows, this is the
            value stored at the registry path:
            <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid</code>.
            In Linux, this is stored in the file: <code>/etc/machine-id</code>.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDevice_TypeId'
          description: The device type ID.
        udid:
          type: string
          nullable: true
          description: >-
            The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS,
            tvOS, watchOS and visionOS devices, this is the UDID. For macOS
            devices, it is the Provisioning UDID. For example:
            <code>00008020-008D4548007B4F26</code>
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor for the device. For example <code>Dell</code> or
            <code>Lenovo</code>.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.6.0emailactivityDevice_NetworkStatusId:
      title: ocsfv1.6.0emailactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.6.0emailactivityDevice_RiskLevelId:
      title: ocsfv1.6.0emailactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityDevice_TypeId:
      title: ocsfv1.6.0emailactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityDeviceHwInfo:
      title: ocsfv1.6.0emailactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_architecture:
          type: string
          nullable: true
          description: >-
            The CPU architecture, normalized to the caption of the
            <code>cpu_architecture_id</code> value. In the case of
            <code>Other</code>, it is defined by the source.
        cpu_architecture_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0emailactivityDeviceHwInfo_CpuArchitectureId
          nullable: true
          description: The normalized identifier of the CPU architecture.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
        uuid:
          type: string
          nullable: true
          description: >-
            The device manufacturer assigned universally unique hardware
            identifier. For SMBIOS compatible devices such as those running
            Linux and Windows, it is the UUID member of the System Information
            structure in the SMBIOS information. For macOS devices, it is the
            Hardware UUID (also known as IOPlatformUUID in the I/O Registry).
        vendor_name:
          type: string
          nullable: true
          description: The device manufacturer.
    ocsfv1.6.0emailactivityDeviceHwInfo_CpuArchitectureId:
      title: ocsfv1.6.0emailactivityDeviceHwInfo_CpuArchitectureId
      type: integer
      description: >-
        DeviceHwInfoCpuArchitectureId is an enum, and the following values are
        allowed.

        0 - Unknown: The CPU architecture is unknown.

        1 - x86: CPU uses the x86 ISA. For bitness, refer to
        <code>cpu_bits</code>.

        2 - ARM: CPU uses the ARM ISA. For bitness, refer to
        <code>cpu_bits</code>.

        3 - V: CPU uses the RISC-V ISA. For bitness, refer to
        <code>cpu_bits</code>.

        99 - Other: The CPU architecture is not mapped. See the
        <code>cpu_architecture</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityDigitalSignature:
      title: ocsfv1.6.0emailactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0emailactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.6.0emailactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.6.0emailactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityDigitalSignature_StateId:
      title: ocsfv1.6.0emailactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityDisplay:
      title: ocsfv1.6.0emailactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.6.0emailactivityDnsAnswer:
      title: ocsfv1.6.0emailactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.6.0emailactivityDnsAnswer_FlagIds:
      title: ocsfv1.6.0emailactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityDomainContact:
      title: ocsfv1.6.0emailactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.6.0emailactivityDomainContact_TypeId:
      title: ocsfv1.6.0emailactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityEmail:
      title: ocsfv1.6.0emailactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction, and can include embedded URLs and files.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Cc values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>.
        cc_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Cc Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            field. For example <code>example.user@usersdomain.com</code>
        delivered_to_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            values. For example <code>example.user@usersdomain.com</code>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile'
          nullable: true
          description: The files embedded or attached to the email.
        from:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header From value, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>.
        from_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header From values. This array should
            contain the value in <code>from</code>. For example
            <code>example.user@usersdomain.com</code>.
        from_mailbox:
          type: string
          nullable: true
          description: >-
            The human-readable email header From Mailbox value. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        from_mailboxes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The human-readable email header From Mailbox values. This array
            should contain the value in <code>from_mailbox</code>. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        is_read:
          type: boolean
          nullable: true
          description: The indication of whether the email has been read.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-ID value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Reply-To value, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Reply-To values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Reply To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        return_path:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The address found in the 'Return-Path' header, which indicates where
            bounce messages (non-delivery reports) should be sent. This address
            is often set by the sending system and may differ from the 'From' or
            'Sender' addresses. For example,
            <code>mailer-daemon@senderserver.com</code>.
        sender:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine readable email address of the system or server that
            actually transmitted the email message, extracted from the email
            headers per RFC 5322. This differs from the <code>from</code> field,
            which shows the message author. The sender field is most commonly
            used when multiple addresses appear in the <code> from_list </code>
            field, or when the transmitting system is different from the message
            author (such as when sending on behalf of someone else).
        sender_mailbox:
          type: string
          nullable: true
          description: >-
            The human readable email address of the system or server that
            actually transmitted the email message, extracted from the email
            headers per RFC 5322. This differs from the
            <code>from_mailbox</code> field, which shows the message author. The
            sender mailbox field is most commonly used when multiple addresses
            appear in the <code> from_mailboxes </code> field, or when the
            transmitting system is different from the message author (such as
            when sending on behalf of someone else).
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header To values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>
        to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the email thread.
        urls:
          type: array
          items:
            type: string
          nullable: true
          description: The URLs embedded in the email.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
    ocsfv1.6.0emailactivityEmailAuth:
      title: ocsfv1.6.0emailactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.6.0emailactivityEncryptionDetails:
      title: ocsfv1.6.0emailactivityEncryptionDetails
      type: object
      description: Details about the encryption methodology utilized.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The encryption algorithm used, normalized to the caption of
            'algorithm_id
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0emailactivityEncryptionDetails_AlgorithmId
          nullable: true
          description: The encryption algorithm used.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key used.
        key_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the key used for encryption. For example,
            AWS KMS Key ARN.
        type:
          type: string
          nullable: true
          description: The type of the encryption used.
    ocsfv1.6.0emailactivityEncryptionDetails_AlgorithmId:
      title: ocsfv1.6.0emailactivityEncryptionDetails_AlgorithmId
      type: integer
      description: >-
        EncryptionDetailsAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DES: Data Encryption Standard Algorithm

        2 - TripleDES: Triple Data Encryption Standard Algorithm

        3 - AES: Advanced Encryption Standard Algorithm.

        4 - RSA: Rivest-Shamir-Adleman Algorithm

        5 - ECC: Elliptic Curve Cryptography Algorithm

        6 - SM2: ShangMi Cryptographic Algorithm

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityEnrichment:
      title: ocsfv1.6.0emailactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.6.0emailactivityEnvironmentVariable:
      title: ocsfv1.6.0emailactivityEnvironmentVariable
      type: object
      description: An environment variable.
      properties:
        name:
          type: string
          description: The name of the environment variable.
        value:
          type: string
          description: The value of the environment variable.
      required:
        - name
        - value
    ocsfv1.6.0emailactivityEpss:
      title: ocsfv1.6.0emailactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.6.0emailactivityExtension:
      title: ocsfv1.6.0emailactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.6.0emailactivityFeature:
      title: ocsfv1.6.0emailactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.6.0emailactivityFile:
      title: ocsfv1.6.0emailactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        drive_type:
          type: string
          nullable: true
          description: >-
            The drive type, normalized to the caption of the
            <code>drive_type_id</code> value. In the case of <code>Other</code>,
            it is defined by the source.
        drive_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile_DriveTypeId'
          nullable: true
          description: Identifies the type of a disk drive, i.e. fixed, removable, etc.
        encryption_details:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEncryptionDetails'
          nullable: true
          description: >-
            The encryption details of the file. Should be populated if the file
            is encrypted.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        internal_name:
          type: string
          nullable: true
          description: >-
            The name of the file as identified within the file itself. This
            contrasts with the name by which the file is known on disk. Where
            available, the internal name is widely used by security
            practitioners and detection content because the on-disk file name is
            not reliable. On the Windows OS, most PE files contain a <a
            href="https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource">VERSIONINFO</a>
            resource from which the internal name can be obtained. On macOS,
            binaries can optionally embed a copy of the application's Info.plist
            file which in turn contains the name of the executable.
        is_deleted:
          type: boolean
          nullable: true
          description: Indicates if the file was deleted from the filesystem.
        is_encrypted:
          type: boolean
          nullable: true
          description: Indicates if the file is encrypted.
        is_public:
          type: boolean
          nullable: true
          description: >-
            Indicates if the file is publicly accessible. For example in an
            object's public access in AWS S3
        is_readonly:
          type: boolean
          nullable: true
          description: Indicates that the file cannot be modified.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFilePath'
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        storage_class:
          type: string
          nullable: true
          description: >-
            The storage class of the file. For example in AWS S3:
            <code>STANDARD, STANDARD_IA, GLACIER</code>.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            file.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile_TypeId'
          description: >-
            The file type ID. Note the distinction between a <code>Regular
            File</code> and an <code>Executable File</code>. If the distinction
            is not known, or not indicated by the log, use <code>Regular
            File</code>. In this case, it should not be assumed that a Regular
            File is not executable.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        uri:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The file URI, such as those reporting by static analysis tools.
            E.g.,
            <code>file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js</code>
        url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUrl'
          nullable: true
          description: The URL of the file, when applicable.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        volume:
          type: string
          nullable: true
          description: The volume on the storage device where the file is located.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.6.0emailactivityFile_ConfidentialityId:
      title: ocsfv1.6.0emailactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityFile_DriveTypeId:
      title: ocsfv1.6.0emailactivityFile_DriveTypeId
      type: integer
      description: >-
        FileDriveTypeId is an enum, and the following values are allowed.

        0 - Unknown: The drive type is unknown.

        1 - Removable: The drive has removable media; for example, a floppy
        drive, thumb drive, or flash card reader.

        2 - Fixed: The drive has fixed media; for example, a hard disk drive or
        flash drive.

        3 - Remote: The drive is a remote (network) drive.

        4 - ROM: The drive is a CD-ROM drive.

        5 - RAMDisk: The drive is a RAM disk.

        99 - Other: The drive type is not mapped. See the
        <code>drive_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityFile_TypeId:
      title: ocsfv1.6.0emailactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        8 - ExecutableFile

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityFingerprint:
      title: ocsfv1.6.0emailactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of <code>algorithm_id</code>. In the case
            of <code>Other</code>, it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.6.0emailactivityFingerprint_AlgorithmId:
      title: ocsfv1.6.0emailactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        8 - 224: Secure Hash Algorithm 2 producing a 224-bit (28-byte) hash
        value.

        9 - 384: Secure Hash Algorithm 2 producing a 384-bit (48-byte) hash
        value.

        10 - 512_224: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value truncated to a 224-bit (28-byte) hash value.

        11 - 512_256: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value truncated to a 256-bit (32-byte) hash value.

        12 - 224: Secure Hash Algorithm 3 producing a 224-bit (28-byte) hash
        value.

        13 - 256: Secure Hash Algorithm 3 producing a 256-bit (32-byte) hash
        value.

        14 - 384: Secure Hash Algorithm 3 producing a 384-bit (48-byte) hash
        value.

        15 - 512: Secure Hash Algorithm 3 producing a 512-bit (64-byte) hash
        value.

        16 - bit: xxHash H3 producing a 64-bit hash value.

        17 - bit: xxHash H3 producing a 128-bit hash value.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityFirewallRule:
      title: ocsfv1.6.0emailactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.6.0emailactivityGroup:
      title: ocsfv1.6.0emailactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization, including but not
        limited to purposes of access control.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.6.0emailactivityHttpHeader:
      title: ocsfv1.6.0emailactivityHttpHeader
      type: object
      description: >-
        The HTTP Header object represents the headers sent in an HTTP request or
        response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the HTTP header.
        value:
          type: string
          description: The value of the HTTP header.
      required:
        - name
        - value
    ocsfv1.6.0emailactivityIdp:
      title: ocsfv1.6.0emailactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        auth_factors:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAuthFactor'
          nullable: true
          description: >-
            The Authentication Factors object describes the different types of
            Multi-Factor Authentication (MFA) methods and/or devices supported
            by the Identity Provider.
        domain:
          type: string
          nullable: true
          description: The primary domain associated with the Identity Provider.
        fingerprint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: >-
            The fingerprint of the X.509 certificate used by the Identity
            Provider.
        has_mfa:
          type: boolean
          nullable: true
          description: The Identity Provider enforces Multi Factor Authentication (MFA).
        issuer:
          type: string
          nullable: true
          description: >-
            The unique identifier (often a URL) used by the Identity Provider as
            its issuer.
        name:
          type: string
          nullable: true
          description: The name of the Identity Provider.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol of the Identity Provider. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        scim:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityScim'
          nullable: true
          description: >-
            The System for Cross-domain Identity Management (SCIM) resource
            object provides a structured set of attributes related to SCIM
            protocols used for identity provisioning and management across
            cloud-based platforms. It standardizes user and group provisioning
            details, enabling identity synchronization and lifecycle management
            with compatible Identity Providers (IdPs) and applications. SCIM is
            defined in <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc7643'>RFC-7634</a>
        sso:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySso'
          nullable: true
          description: >-
            The Single Sign-On (SSO) object provides a structure for normalizing
            SSO attributes, configuration, and/or settings from Identity
            Providers.
        state:
          type: string
          nullable: true
          description: >-
            The configuration state of the Identity Provider, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityIdp_StateId'
          nullable: true
          description: >-
            The normalized state ID of the Identity Provider to reflect its
            configuration or activation status.
        tenant_uid:
          type: string
          nullable: true
          description: The tenant ID associated with the Identity Provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the Identity Provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The URL for accessing the configuration or metadata of the Identity
            Provider.
    ocsfv1.6.0emailactivityIdp_StateId:
      title: ocsfv1.6.0emailactivityIdp_StateId
      type: integer
      description: >-
        IdpStateId is an enum, and the following values are allowed.

        0 - Unknown: The configuration state of the Identity Provider is
        unknown.

        1 - Active: The Identity Provider is in an Active state, or otherwise
        enabled.

        2 - Suspended: The Identity Provider is in a Suspended state.

        3 - Deprecated: The Identity Provider is in a Deprecated state, or is
        otherwise disabled.

        4 - Deleted: The Identity Provider is in a Deleted state.

        99 - Other: The configuration state of the Identity Provider is not
        mapped. See the <code>state</code> attribute, which contains a data
        source specific value.
    ocsfv1.6.0emailactivityImage:
      title: ocsfv1.6.0emailactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the image.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFilePath'
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            image.
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.6.0emailactivityKbArticle:
      title: ocsfv1.6.0emailactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the kb article.
    ocsfv1.6.0emailactivityKbArticle_InstallStateId:
      title: ocsfv1.6.0emailactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityKeyValueObject:
      title: ocsfv1.6.0emailactivityKeyValueObject
      type: object
      description: A generic object allowing to define a <code>{key:value}</code> pair.
      properties:
        name:
          type: string
          description: The name of the key.
        value:
          type: string
          nullable: true
          description: The value associated to the key.
        values:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Optional, the values associated to the key. You can populate this
            attribute, when you have multiple values for the same key.
      required:
        - name
    ocsfv1.6.0emailactivityKeyboardInfo:
      title: ocsfv1.6.0emailactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.6.0emailactivityKillChainPhase:
      title: ocsfv1.6.0emailactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.6.0emailactivityKillChainPhase_PhaseId:
      title: ocsfv1.6.0emailactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityLdapPerson:
      title: ocsfv1.6.0emailactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        display_name:
          type: string
          nullable: true
          description: >-
            The display name of the LDAP person. According to RFC 2798, this is
            the preferred name of a person to be used when displaying entries.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0emailactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        phone_number:
          type: string
          nullable: true
          description: >-
            The telephone number of the user. Corresponds to the LDAP
            <code>Telephone-Number</code> CN.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            user.
    ocsfv1.6.0emailactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.6.0emailactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityLocation:
      title: ocsfv1.6.0emailactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address.
      properties:
        aerial_height:
          type: string
          nullable: true
          description: >-
            Expressed as either height above takeoff location or height above
            ground level (AGL) for a UAS current location. This value is
            provided in meters and must have a minimum resolution of 1 m.
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code.<p><b>Note:</b> The two letter
            country code should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geodetic_altitude:
          type: string
          nullable: true
          description: >-
            The aircraft distance above or below the ellipsoid as measured along
            a line that passes through the aircraft and is normal to the surface
            of the WGS-84 ellipsoid. This value is provided in meters and must
            have a minimum resolution of 1 m. Special Values:
            <code>Invalid</code>, <code>No Value</code>, or <code>Unknown: -1000
            m</code>.
        geodetic_vertical_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on geodetic altitude. This is based on
            ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        horizontal_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on horizontal position. This is based
            on ADS-B NACp. Measured in meters.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        pressure_altitude:
          type: string
          nullable: true
          description: >-
            The uncorrected barometric pressure altitude (based on reference
            standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms
            that utilize 'altitude deltas' between aircraft. This value is
            provided in meters and must have a minimum resolution of 1 m..
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. For example, 'CH-VD' for
            the Canton of Vaud, Switzerland
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.6.0emailactivityLogger:
      title: ocsfv1.6.0emailactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDevice'
          nullable: true
          description: The device where the events are logged.
        event_uid:
          type: string
          nullable: true
          description: The unique identifier of the event assigned by the logger.
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the OCSF event data has been truncated due to size
            limitations. When <code>true</code>, some event data may have been
            omitted to fit within system constraints.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The original size of the OCSF event data in kilobytes before any
            truncation occurred. This field is typically populated when
            <code>is_truncated</code> is <code>true</code> to indicate the full
            size of the original event.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.6.0emailactivityLongString:
      title: ocsfv1.6.0emailactivityLongString
      type: object
      description: >-
        This object is a used to capture strings which may be truncated by a
        security product due to their length.
      properties:
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates that <code>value</code> has been truncated. May be omitted
            if truncation has not occurred.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The size in bytes of the string represented by <code>value</code>
            before truncation. Should be omitted if truncation has not occurred.
        value:
          type: string
          description: >-
            The string value, truncated if <code>is_truncated</code> is
            <code>true</code>.
      required:
        - value
    ocsfv1.6.0emailactivityMalware:
      title: ocsfv1.6.0emailactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0emailactivityMalware_ClassificationIds
          description: The list of normalized identifiers of the malware classifications.
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityCve'
          nullable: true
          description: >-
            The list of Common Vulnerabilities and Exposures (CVE) identifiers
            associated with the malware. Reference: <a target="_blank"
            href="https://cve.mitre.org/">CVE</a>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile'
          nullable: true
          description: >-
            The list of file objects representing files that were identified as
            infected by the malware.
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The number of files that were identified to be infected by the
            malware.
        path:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFilePath'
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: >-
            The name or identifier of the security solution or service that
            provided the malware detection information.
        severity:
          type: string
          nullable: true
          description: >-
            The severity of the malware, normalized to the captions of the
            <code>severity_id</code> values. In the case of 'Other', they are
            defined by the event source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMalware_SeverityId'
          nullable: true
          description: The normalized identifier of the malware severity.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the specific malware instance, as assigned
            by the detection engine (e.g., virus signature ID or IPS rule ID).
      required:
        - classification_ids
    ocsfv1.6.0emailactivityMalware_ClassificationIds:
      title: ocsfv1.6.0emailactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityMalware_SeverityId:
      title: ocsfv1.6.0emailactivityMalware_SeverityId
      type: integer
      description: >-
        MalwareSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityMalwareScanInfo:
      title: ocsfv1.6.0emailactivityMalwareScanInfo
      type: object
      description: >-
        The malware scan information object describes characteristics, metadata
        of a malware scanning job.
      properties:
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        name:
          type: string
          nullable: true
          description: >-
            The administrator-supplied or application-generated name of the
            scan. For example: "Home office weekly user database scan", "Scan
            folders for viruses", "Full system virus scan"
        num_files:
          type: integer
          nullable: true
          description: The total number of files analyzed during the scan.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The total number of files identified as infected with malware during
            the scan.
        num_volumes:
          type: integer
          nullable: true
          description: >-
            The total number of storage volumes examined during the malware
            scan.
        size:
          type: integer
          nullable: true
          description: The total size in bytes of all files that were scanned.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        targets:
          type: array
          items:
            type: string
          nullable: true
          description: Hosts or IP addresses targeted by the scan.
        type:
          type: string
          nullable: true
          description: The type of scan.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMalwareScanInfo_TypeId'
          description: The type id of the scan.
        uid:
          type: string
          nullable: true
          description: >-
            The application-defined unique identifier assigned to an instance of
            a scan.
        unique_malware_count:
          type: integer
          nullable: true
          description: The number of unique malware detected across all infected files.
      required:
        - type_id
    ocsfv1.6.0emailactivityMalwareScanInfo_TypeId:
      title: ocsfv1.6.0emailactivityMalwareScanInfo_TypeId
      type: integer
      description: >-
        MalwareScanInfoTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Manual: The scan was manually initiated by the user or
        administrator.

        2 - Scheduled: The scan was started based on scheduler.

        3 - UpdatedContent: The scan was triggered by a content update.

        4 - QuarantinedItems: The scan was triggered by newly quarantined items.

        5 - AttachedMedia: The scan was triggered by the attachment of removable
        media.

        6 - UserLogon: The scan was started due to a user logon.

        7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM)
        detection.

        99 - Other: The scan type id is not mapped. See the <code>type</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0emailactivityMetadata:
      title: ocsfv1.6.0emailactivityMetadata
      type: object
      description: The Metadata object describes the metadata associated with the event.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        debug:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Debug information about non-fatal issues with this OCSF event. Each
            issue is a line in this string array.
        event_code:
          type: string
          nullable: true
          description: >-
            The <code>Event ID, Code, or Name</code> that the product uses to
            primarily identify the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the OCSF event data has been truncated due to size
            limitations. When <code>true</code>, some event data may have been
            omitted to fit within system constraints.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of labels attached to the event. For example:
            <code>["sample", "dev"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            event.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        transformation_info_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityTransformationInfo'
          nullable: true
          description: >-
            An array of transformation info that describes the mappings or
            transforms applied to the data.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The original size of the OCSF event data in kilobytes before any
            truncation occurred. This field is typically populated when
            <code>is_truncated</code> is <code>true</code> to indicate the full
            size of the original event.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example:
            <code>1.0.0.</code> Event consumers use the version to determine the
            available event attributes.
      required:
        - product
        - version
    ocsfv1.6.0emailactivityMetric:
      title: ocsfv1.6.0emailactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.6.0emailactivityMitigation:
      title: ocsfv1.6.0emailactivityMitigation
      type: object
      description: >-
        The MITRE Mitigation object describes the ATT&amp;CK® or ATLAS™
        Mitigation ID and/or name that is associated to an attack.
      properties:
        countermeasures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityD3fend'
          nullable: true
          description: >-
            The D3FEND countermeasures that are associated with the attack
            technique. For example: ATT&amp;CK Technique <code>T1003</code> is
            addressed by Mitigation <code>M1027</code>, and D3FEND Technique
            <code>D3-OTP</code>.
        name:
          type: string
          nullable: true
          description: >-
            The Mitigation name that is associated with the attack technique.
            For example: <code>Password Policies</code>, or <code>Code
            Signing</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the Mitigation. For example:
            <code>https://attack.mitre.org/versions/v14/mitigations/M1027</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Mitigation ID that is associated with the attack technique. For
            example: <code>M1027</code>, or <code>AML.M0013</code>.
    ocsfv1.6.0emailactivityNetworkEndpoint:
      title: ocsfv1.6.0emailactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: >-
            The name of the domain that the endpoint belongs to or that
            corresponds to the endpoint.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.6.0emailactivityNetworkEndpoint_TypeId:
      title: ocsfv1.6.0emailactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityNetworkInterface:
      title: ocsfv1.6.0emailactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a physical or virtual network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        open_ports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityPortInfo'
          nullable: true
          description: >-
            The list of open ports on a network interface, including port
            numbers and associated protocol information.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkInterface_TypeId'
          nullable: true
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
    ocsfv1.6.0emailactivityNetworkInterface_TypeId:
      title: ocsfv1.6.0emailactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityNetworkProxy:
      title: ocsfv1.6.0emailactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: >-
            The name of the domain that the endpoint belongs to or that
            corresponds to the endpoint.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.6.0emailactivityNetworkProxy_TypeId:
      title: ocsfv1.6.0emailactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityObject:
      title: ocsfv1.6.0emailactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.6.0emailactivityObservable:
      title: ocsfv1.6.0emailactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the OCSF event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - type_id
    ocsfv1.6.0emailactivityObservable_TypeId:
      title: ocsfv1.6.0emailactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. It may be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example:<br /><code>john_doe</code>.

        5 - EmailAddress: Email address. For example:<br
        /><code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example:<br /><code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example:<br />
        MD5: <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example:<br /><code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example:<br
        /><code>80</code>,<br /><code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction, and can include embedded URLs and
        files.

        23 - UniformResourceLocator: The Uniform Resource Locator (URL) object
        describes the characteristics of a URL.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details.

        25 - Process: The Process object describes a running instance of a
        launched program.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        45 - FilePath: The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.6.0emailactivityOrganization:
      title: ocsfv1.6.0emailactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any. Additionally, it also describes cloud
        and Software-as-a-Service (SaaS) logical hierarchies such as AWS
        Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and
        similar constructs.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the organization, Oracle Cloud Tenancy, Google Cloud
            Organization, or AWS Organization. For example, <code> Widget, Inc.
            </code> or the <code> AWS Organization name </code>.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of an organizational unit, Google Cloud Folder, or AWS Org
            Unit. For example, the <code> GCP Project Name </code>, or <code>
            Dev_Prod_OU </code>.
        ou_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of an organizational unit, Google Cloud
            Folder, or AWS Org Unit. For example, an <code> Oracle Cloud Tenancy
            ID </code>, <code> AWS OU ID </code>, or <code> GCP Folder ID
            </code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization, Oracle Cloud Tenancy,
            Google Cloud Organization, or AWS Organization. For example, an
            <code> AWS Org ID </code> or <code> Oracle Cloud Domain ID </code>.
    ocsfv1.6.0emailactivityOs:
      title: ocsfv1.6.0emailactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code).<p><b>Note:</b> The two letter country code
            should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        kernel_release:
          type: string
          nullable: true
          description: >-
            The kernel release of the operating system. On Unix-based systems,
            this is determined from the <code>uname -r</code> command output,
            for example "5.15.0-122-generic".
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.6.0emailactivityOs_TypeId:
      title: ocsfv1.6.0emailactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.6.0emailactivityOsint:
      title: ocsfv1.6.0emailactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        campaign:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCampaign'
          nullable: true
          description: >-
            The campaign object describes details about the campaign that was
            the source of the activity.
        category:
          type: string
          nullable: true
          description: >-
            Categorizes the threat indicator based on its functional or
            operational role.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        creator:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: >-
            The identifier of the user, system, or organization that contributed
            the indicator.
        desc:
          type: string
          nullable: true
          description: >-
            A detailed explanation of the indicator, including its context,
            purpose, and relevance.
        detection_pattern:
          type: string
          nullable: true
          description: >-
            The specific detection pattern or signature associated with the
            indicator.
        detection_pattern_type:
          type: string
          nullable: true
          description: >-
            The detection pattern type, normalized to the caption of the
            detection_pattern_type_id value. In the case of 'Other', it is
            defined by the event source.
        detection_pattern_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0emailactivityOsint_DetectionPatternTypeId
          nullable: true
          description: >-
            Specifies the type of detection pattern used to identify the
            associated threat indicator.
        email:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        external_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier assigned by an external system for
            cross-referencing.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile'
          nullable: true
          description: >-
            Any pertinent file information related to an indicator or OSINT
            analysis.
        intrusion_sets:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A grouping of adversarial behaviors and resources believed to be
            associated with specific threat actors or campaigns. Intrusion sets
            often encompass multiple campaigns and are used to organize related
            activities under a common label.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Tags or keywords associated with the indicator to enhance
            searchability.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        name:
          type: string
          nullable: true
          description: >-
            The <code>name</code> is a pointer/reference to an attribute within
            the OCSF event data. For example: file.name.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Provides a reference to an external source of information related to
            the CTI being represented. This may include a URL, a document, or
            some other type of reference that provides additional context or
            information about the CTI.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAnalytic'
          nullable: true
          description: Any analytics related to an indicator or OSINT analysis.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityReputation'
          nullable: true
          description: >-
            Related reputational analysis from third-party engines and analysts
            for a given indicator or OSINT analysis.
        risk_score:
          type: integer
          nullable: true
          description: A numerical representation of the threat indicator’s risk level.
        script:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityScript'
          nullable: true
          description: >-
            Any pertinent script information related to an indicator or OSINT
            analysis.
        severity:
          type: string
          nullable: true
          description: >-
            Represents the severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOsint_SeverityId'
          nullable: true
          description: >-
            The normalized severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySubnet'
          nullable: true
          description: A CIDR or network block related to an indicator or OSINT analysis.
        threat_actor:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityThreatActor'
          nullable: true
          description: >-
            A threat actor is an individual or group that conducts malicious
            cyber activities, often with financial, political, or ideological
            motives.
        tlp:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the OSINT object.
        uploaded_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        uploaded_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.6.0emailactivityOsint_ConfidenceId:
      title: ocsfv1.6.0emailactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityOsint_DetectionPatternTypeId:
      title: ocsfv1.6.0emailactivityOsint_DetectionPatternTypeId
      type: integer
      description: >-
        OsintDetectionPatternTypeId is an enum, and the following values are
        allowed.

        0 - Unknown: The type is not mapped.

        1 - STIX

        2 - PCRE

        3 - SIGMA

        4 - Snort

        5 - Suricata

        6 - YARA

        99 - Other: The detection pattern type is not mapped. See the
        <code>detection_pattern_type</code> attribute, which contains a data
        source specific value.
    ocsfv1.6.0emailactivityOsint_SeverityId:
      title: ocsfv1.6.0emailactivityOsint_SeverityId
      type: integer
      description: >-
        OsintSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityOsint_Tlp:
      title: ocsfv1.6.0emailactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.

        WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably,
        TLP:WHITE is the most up to date (as of TLP 2.0) usage.
    ocsfv1.6.0emailactivityOsint_TypeId:
      title: ocsfv1.6.0emailactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP,
        VHASH, etc. generated from a file, malware sample, request header, or
        otherwise used to identify a pertinent artifact.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        11 - File: A file or metadata about a file.

        12 - RegistryKey: A Windows Registry Key.

        13 - RegistryValue: A Windows Registry Value.

        14 - CommandLine: A partial or full Command Line used to invoke scripts
        or other remote commands.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.6.0emailactivityPackage:
      title: ocsfv1.6.0emailactivityPackage
      type: object
      description: The Software Package object describes details about a software package.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.6.0emailactivityPackage_TypeId:
      title: ocsfv1.6.0emailactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityPolicy:
      title: ocsfv1.6.0emailactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        data:
          nullable: true
          description: >-
            Additional data about the policy such as the underlying JSON policy
            itself or other details.
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: >-
            The policy name. For example: <code>AdministratorAccess
            Policy</code>.
        type:
          type: string
          nullable: true
          description: >-
            The policy type. For example: <code>Identity Policy, Resource
            Policy, Service Control Policy, etc./code&gt;.</code>
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.6.0emailactivityPortInfo:
      title: ocsfv1.6.0emailactivityPortInfo
      type: object
      description: >-
        The Port Information object describes a port and its associated protocol
        details.
      properties:
        port:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPort'
          description: >-
            The port number. For example: <code>80</code>, <code>443</code>,
            <code>22</code>.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). For example: <code>tcp</code> or
            <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The IP protocol number, as defined by the Internet Assigned Numbers
            Authority (IANA). For example: <code>6</code> for TCP and
            <code>17</code> for UDP.
      required:
        - port
    ocsfv1.6.0emailactivityProcess:
      title: ocsfv1.6.0emailactivityProcess
      type: object
      description: The Process object describes a running instance of a launched program.
      properties:
        ancestry:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityProcessEntity'
          nullable: true
          description: >-
            An array of Process Entities describing the extended parentage of
            this process object. Direct parent information should be expressed
            through the <code>parent_process</code> attribute. The first array
            element is the direct parent of this process object. Subsequent list
            elements go up the process parentage hierarchy. That is, the array
            is sorted from newest to oldest process. It is recommended to only
            populate this field for the top-level process object.
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        environment_variables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityEnvironmentVariable'
          nullable: true
          description: Environment variables associated with the process.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityFilePath'
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the top-level process object, to prevent
            deep nesting. Additional ancestry information can be supplied in the
            <code>ancestry</code> attribute.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        ptid:
          type: integer
          nullable: true
          description: >-
            The identifier of the process thread associated with the event, as
            returned by the operating system.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser'
          nullable: true
          description: The user under which this process is running.
        working_directory:
          type: string
          nullable: true
          description: The working directory of a process.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.6.0emailactivityProcess_IntegrityId:
      title: ocsfv1.6.0emailactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityProcessEntity:
      title: ocsfv1.6.0emailactivityProcessEntity
      type: object
      description: >-
        The Process Entity object provides critical fields for referencing a
        process.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
    ocsfv1.6.0emailactivityProduct:
      title: ocsfv1.6.0emailactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.6.0emailactivityProgrammaticCredential:
      title: ocsfv1.6.0emailactivityProgrammaticCredential
      type: object
      description: >-
        The Programmatic Credential object describes service-specific
        credentials used for direct API access and system integration. These
        credentials are typically issued by individual services or platforms for
        accessing their APIs and resources, focusing on credential lifecycle
        management and usage tracking. Examples include API keys, service
        account keys, client certificates, and vendor-specific access tokens.
      properties:
        last_used_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when this programmatic credential was last used for
            authentication or API access. This helps track credential usage
            patterns, identify dormant credentials that may pose security risks,
            and support credential lifecycle management. The timestamp should
            reflect the most recent successful authentication or API call using
            this credential.
        last_used_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when this programmatic credential was last used for
            authentication or API access. This helps track credential usage
            patterns, identify dormant credentials that may pose security risks,
            and support credential lifecycle management. The timestamp should
            reflect the most recent successful authentication or API call using
            this credential.
        type:
          type: string
          nullable: true
          description: >-
            The type or category of programmatic credential, normalized to the
            caption of the type_id value. In the case of 'Other', it is defined
            by the event source. Examples include 'API Key', 'Service Account
            Key', 'Access Token', 'Client Certificate', 'OAuth Token', 'Personal
            Access Token', etc.
        uid:
          type: string
          description: >-
            The unique identifier of the programmatic credential. This could be
            an API key ID, service account key ID, access token identifier,
            certificate serial number, or other unique identifier that
            distinguishes this credential from others. Examples: AWS Access Key
            ID, GCP Service Account Key ID, Azure Application ID, or OAuth2
            token identifier.
      required:
        - uid
    ocsfv1.6.0emailactivityRemediation:
      title: ocsfv1.6.0emailactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        cis_controls:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityCisControl'
          nullable: true
          description: >-
            An array of Center for Internet Security (CIS) Controls that can be
            optionally mapped to provide additional remediation details.
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.6.0emailactivityReputation:
      title: ocsfv1.6.0emailactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.6.0emailactivityReputation_ScoreId:
      title: ocsfv1.6.0emailactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityRequest:
      title: ocsfv1.6.0emailactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api request.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.6.0emailactivityResponse:
      title: ocsfv1.6.0emailactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api response.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.6.0emailactivityRule:
      title: ocsfv1.6.0emailactivityRule
      type: object
      description: >-
        The Rule object describes characteristics of a rule associated with a
        policy or an event.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.6.0emailactivitySan:
      title: ocsfv1.6.0emailactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.6.0emailactivityScim:
      title: ocsfv1.6.0emailactivityScim
      type: object
      description: >-
        The System for Cross-domain Identity Management (SCIM) Configuration
        object provides a structured set of attributes related to SCIM protocols
        used for identity provisioning and management across cloud-based
        platforms. It standardizes user and group provisioning details, enabling
        identity synchronization and lifecycle management with compatible
        Identity Providers (IdPs) and applications. SCIM is defined in <a
        target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityScim_AuthProtocolId'
          nullable: true
          description: >-
            The normalized identifier of the authorization protocol used by the
            SCIM resource.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: When the SCIM resource was added to the service provider.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SCIM resource was added to the service provider.
        error_message:
          type: string
          nullable: true
          description: Message or code associated with the last encountered error.
        is_group_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            groups, automatically or otherwise.
        is_user_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            users, automatically or otherwise.
        last_run_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        name:
          type: string
          nullable: true
          description: The name of the SCIM resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SCIM resource. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        rate_limit:
          type: integer
          nullable: true
          description: >-
            Maximum number of requests allowed by the SCIM resource within a
            specified time frame to avoid throttling.
        scim_group_schema:
          nullable: true
          description: >-
            SCIM provides a schema for representing groups, identified using the
            following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:Group</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            This attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource.
        scim_user_schema:
          nullable: true
          description: >-
            SCIM provides a resource type for user resources. The core schema
            for user is identified using the following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:User</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            his attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource. This object is inclusive of both the
            basic and Enterprise User Schema Extension.
        state:
          type: string
          nullable: true
          description: >-
            The provisioning state of the SCIM resource, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityScim_StateId'
          nullable: true
          description: >-
            The normalized state ID of the SCIM resource to reflect its
            activation status.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for a SCIM resource as defined by the service
            provider.
        uid_alt:
          type: string
          nullable: true
          description: >-
            A String that is an identifier for the resource as defined by the
            provisioning client. The <code>externalId</code> may simplify
            identification of a resource between the provisioning client and the
            service provider by allowing the client to use a filter to locate
            the resource with an identifier from the provisioning domain,
            obviating the need to store a local mapping between the provisioning
            domain's identifier of the resource and the identifier used by the
            service provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: The primary URL for SCIM API requests.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SCIM. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
        version:
          type: string
          nullable: true
          description: SCIM protocol version supported e.g., <code>SCIM 2.0</code>.
    ocsfv1.6.0emailactivityScim_AuthProtocolId:
      title: ocsfv1.6.0emailactivityScim_AuthProtocolId
      type: integer
      description: >-
        ScimAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityScim_StateId:
      title: ocsfv1.6.0emailactivityScim_StateId
      type: integer
      description: >-
        ScimStateId is an enum, and the following values are allowed.

        0 - Unknown: The provisioning state of the SCIM resource is unknown.

        1 - Pending: The SCIM resource is Pending activation or creation.

        2 - Active: The SCIM resource is in an Active state, or otherwise
        enabled.

        3 - Failed: The SCIM resource is in a Failed state.

        4 - Deleted: The SCIM resource is in a Deleted state, or otherwise
        disabled.

        99 - Other: The provisioning state of the SCIM resource is not mapped.
        See the <code>state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityScript:
      title: ocsfv1.6.0emailactivityScript
      type: object
      description: >-
        The Script object describes a script or command that can be executed by
        a shell, script engine, or interpreter. Examples include Bash,
        JavsScript, PowerShell, Python, VBScript, etc. Note that the term
        <em>script</em> here denotes not only a script contained within a file
        but also a script or command typed interactively by a user, supplied on
        the command line, or provided by some other file-less mechanism.
      properties:
        file:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityFile'
          nullable: true
          description: >-
            Present if this script is associated with a file. Not present in the
            case of a file-less script.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityFingerprint'
          nullable: true
          description: >-
            An array of the script's cryptographic hashes. Note that these
            hashes are calculated on the script in its original encoding, and
            not on the normalized UTF-8 encoding found in the
            <code>script_content</code> attribute.
        name:
          type: string
          nullable: true
          description: >-
            Unique identifier for the script or macro, independent of the
            containing file, used for tracking, auditing, and security analysis.
        parent_uid:
          type: string
          nullable: true
          description: >-
            This attribute relates a sub-script to a parent script having the
            matching <code>uid</code> attribute. In the case of PowerShell,
            sub-script execution can be identified by matching the activity
            correlation ID of the raw ETW events provided by the OS.
        script_content:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLongString'
          description: >-
            The script content, normalized to UTF-8 encoding irrespective of its
            original encoding. When emitting this attribute, it may be
            appropriate to truncate large scripts. When consuming this
            attribute, large scripts should be anticipated.
        type:
          type: string
          nullable: true
          description: >-
            The script type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityScript_TypeId'
          description: The normalized script type ID.
        uid:
          type: string
          nullable: true
          description: >-
            Some script engines assign a unique ID to each individual execution
            of a given script. This attribute captures that unique ID. In the
            case of PowerShell, the unique ID corresponds to the
            <code>ScriptBlockId</code> in the raw ETW events provided by the OS.
      required:
        - script_content
        - type_id
    ocsfv1.6.0emailactivityScript_TypeId:
      title: ocsfv1.6.0emailactivityScript_TypeId
      type: integer
      description: >-
        ScriptTypeId is an enum, and the following values are allowed.

        0 - Unknown: The script type is unknown.

        1 - WindowsCommandPrompt

        2 - PowerShell

        3 - Python

        4 - JavaScript

        5 - VBScript

        6 - UnixShell

        7 - VBA

        99 - Other: The script type is not mapped. See the <code>type</code>
        attribute which contains an event source specific value.
    ocsfv1.6.0emailactivityService:
      title: ocsfv1.6.0emailactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.6.0emailactivitySession:
      title: ocsfv1.6.0emailactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.6.0emailactivitySso:
      title: ocsfv1.6.0emailactivitySso
      type: object
      description: >-
        The Single Sign-On (SSO) object provides a structure for normalizing SSO
        attributes, configuration, and/or settings from Identity Providers.
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySso_AuthProtocolId'
          nullable: true
          description: >-
            The normalized identifier of the authentication protocol used by the
            SSO resource.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCertificate'
          nullable: true
          description: >-
            Digital Signature associated with the SSO resource, e.g., SAML X.509
            certificate details.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: When the SSO resource was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SSO resource was created.
        duration_mins:
          type: integer
          nullable: true
          description: >-
            The duration (in minutes) for an SSO session, after which
            re-authentication is required.
        idle_timeout:
          type: integer
          nullable: true
          description: >-
            Duration (in minutes) of allowed inactivity before Single Sign-On
            (SSO) session expiration.
        login_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: URL for initiating an SSO login request.
        logout_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            URL for initiating an SSO logout request, allowing sessions to be
            terminated across applications.
        metadata_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            URL where metadata about the SSO configuration is available (e.g.,
            for SAML configurations).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The most recent time when the SSO resource was updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent time when the SSO resource was updated.
        name:
          type: string
          nullable: true
          description: The name of the SSO resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SSO resource. E.g., <code>SAML</code>
            or <code>OIDC</code>.
        scopes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Scopes define the specific permissions or actions that the client is
            allowed to perform on behalf of the user. Each scope represents a
            different set of permissions, and the user can selectively grant or
            deny access to specific scopes during the authorization process.
        uid:
          type: string
          nullable: true
          description: A unique identifier for a SSO resource.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SSO. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
    ocsfv1.6.0emailactivitySso_AuthProtocolId:
      title: ocsfv1.6.0emailactivitySso_AuthProtocolId
      type: integer
      description: >-
        SsoAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivitySubTechnique:
      title: ocsfv1.6.0emailactivitySubTechnique
      type: object
      description: >-
        The MITRE Sub-technique object describes the ATT&amp;CK® or ATLAS™
        Sub-technique ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub-technique. For example: <code>Scanning IP
            Blocks</code> or <code>User Execution: Unsafe ML Artifacts</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub-technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub-technique. For example:
            <code>T1595.001</code> or <code>AML.T0011.000</code>.
    ocsfv1.6.0emailactivityTactic:
      title: ocsfv1.6.0emailactivityTactic
      type: object
      description: >-
        The MITRE Tactic object describes the ATT&amp;CK® or ATLAS™ Tactic ID
        and/or name that is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The Tactic name that is associated with the attack technique. For
            example: <code>Reconnaissance</code> or <code>ML Model
            Access</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the Tactic. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Tactic ID that is associated with the attack technique. For
            example: <code>TA0043</code>, or <code>AML.TA0000</code>.
    ocsfv1.6.0emailactivityTechnique:
      title: ocsfv1.6.0emailactivityTechnique
      type: object
      description: >-
        The MITRE Technique object describes the ATT&amp;CK® or ATLAS™ Technique
        ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique. For example: <code>Active
            Scanning</code> or <code>AI Model Inference API Access</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique. For example:
            <code>T1595</code> or <code>AML.T0040</code>.
    ocsfv1.6.0emailactivityThreatActor:
      title: ocsfv1.6.0emailactivityThreatActor
      type: object
      description: Threat actor is responsible for the observed malicious activity.
      properties:
        name:
          type: string
          description: The name of the threat actor.
        type:
          type: string
          nullable: true
          description: >-
            The classification of the threat actor based on their motivations,
            capabilities, or affiliations. Common types include nation-state
            actors, cybercriminal groups, hacktivists, or insider threats.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityThreatActor_TypeId'
          nullable: true
          description: The normalized datastore resource type identifier.
      required:
        - name
    ocsfv1.6.0emailactivityThreatActor_TypeId:
      title: ocsfv1.6.0emailactivityThreatActor_TypeId
      type: integer
      description: |-
        ThreatActorTypeId is an enum, and the following values are allowed.
        0 - Unknown: The threat actor type is unknown.
        1 - state
        2 - Cybercriminal
        3 - Hacktivists
        4 - Insider
        99 - Other: The threat actor type is not mapped.
    ocsfv1.6.0emailactivityTimespan:
      title: ocsfv1.6.0emailactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may be populated since each member is of integral type. In
        that case <code>type_id</code> if present should be set to
        <code>Other.</code><p>A timespan may also be defined by its time
        interval boundaries, <code>start_time</code> and
        <code>end_time</code>.</p>
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The start time or beginning of the timespan's interval.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The start time or beginning of the timespan's interval.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.6.0emailactivityTimespan_TypeId:
      title: ocsfv1.6.0emailactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        9 - TimeInterval: The <code>start_time</code> and <code>end_time</code>
        should be set.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityTransformationInfo:
      title: ocsfv1.6.0emailactivityTransformationInfo
      type: object
      description: >-
        The transformation_info object represents the mapping or transformation
        used.
      properties:
        lang:
          type: string
          nullable: true
          description: The transformation language used to transform the data.
        name:
          type: string
          nullable: true
          description: The name of the transformation or mapping.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityProduct'
          nullable: true
          description: The product or instance used to make the transformation
        time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: Time of the transformation.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: Time of the transformation.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the mapping or transformation.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The Uniform Resource Locator String where the mapping or
            transformation exists.
    ocsfv1.6.0emailactivityUrl:
      title: ocsfv1.6.0emailactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator (URL) object describes the characteristics
        of a URL.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.6.0emailactivityUrl_CategoryIds:
      title: ocsfv1.6.0emailactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.6.0emailactivityUser:
      title: ocsfv1.6.0emailactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        display_name:
          type: string
          nullable: true
          description: The display name of the user, as reported by the product.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        forward_addr:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The user's forwarding email address.
        full_name:
          type: string
          nullable: true
          description: The full name of the user, as reported by the product.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        phone_number:
          type: string
          nullable: true
          description: The telephone number of the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        programmatic_credentials:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityProgrammaticCredential'
          nullable: true
          description: >-
            Details about the programmatic credential (API keys, access tokens,
            certificates, etc) associated to the user.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.6.0emailactivityUser_MfaStatusId:
      title: ocsfv1.6.0emailactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityUser_RiskLevelId:
      title: ocsfv1.6.0emailactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0emailactivityUser_TypeId:
      title: ocsfv1.6.0emailactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        4 - Service: Service account. For example, Windows service account.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0emailactivityUser_UserStatusId:
      title: ocsfv1.6.0emailactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityVulnerability:
      title: ocsfv1.6.0emailactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        advisory:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAdvisory'
          nullable: true
          description: >-
            Detail about the security advisory, that is used to publicly
            disclose cybersecurity vulnerabilities by a vendor.
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        category:
          type: string
          nullable: true
          description: >-
            The category of a vulnerability or weakness, as reported by the
            source tool, such as <code>Container Security</code> or <code>Open
            Source Security</code>.
        cve:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCve'
          nullable: true
          description: >-
            Describes the Common Vulnerabilities and Exposures <a
            target='_blank' href='https://cve.mitre.org/'>(CVE)</a> details
            related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target='_blank'
            href='https://cwe.mitre.org/'>(CWE)</a> details related to the
            vulnerability.
        dependency_chain:
          type: string
          nullable: true
          description: >-
            Information about the chain of dependencies related to the issue as
            reported by an Application Security or Vulnerability Management
            tool. E.g., <code>serverless-offline -&gt; @serverless/utils -&gt;
            memoizee -&gt; es5-ext</code>.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        exploit_last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_ref_url:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityURLString'
          nullable: true
          description: The URL of the exploit code or Proof-of-Concept (PoC).
        exploit_requirement:
          type: string
          nullable: true
          description: >-
            The requirement description related to any constraints around
            exploit execution.
        exploit_type:
          type: string
          nullable: true
          description: >-
            The categorization or type of Exploit. E.g., <code>Network</code> or
            <code>Physical</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        fix_coverage:
          type: string
          nullable: true
          description: >-
            The fix coverage, normalized to the caption of the
            <code>fix_coverage_id</code> value.
        fix_coverage_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0emailactivityVulnerability_FixCoverageId
          nullable: true
          description: >-
            The normalized identifier for fix coverage, applicable to this
            vulnerability. Typically useful, when there are multiple affected
            packages but only a subset have available fixes.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            List of vulnerability IDs (e.g. CVE ID) that are related to this
            vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.6.0emailactivityVulnerability_FixCoverageId:
      title: ocsfv1.6.0emailactivityVulnerability_FixCoverageId
      type: integer
      description: >-
        VulnerabilityFixCoverageId is an enum, and the following values are
        allowed.

        0 - Unknown: The fix coverage is unknown.

        1 - Complete: All affected packages and components have available fixes
        or patches to remediate the vulnerability.

        2 - Partial: Only some of the affected packages and components have
        available fixes or patches, while others remain vulnerable.

        3 - None: No fixes or patches are currently available for any of the
        affected packages and components.

        99 - Other: The fix coverage is not mapped. See the
        <code>fix_coverage</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0emailactivityWhois:
      title: ocsfv1.6.0emailactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The domain name corresponding to the WHOIS record.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0emailactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0emailactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.6.0emailactivityWhois_DnssecStatusId:
      title: ocsfv1.6.0emailactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityEmailAddress:
      title: ocsfv1.6.0filehostingactivityEmailAddress
      type: string
      description: Email address. For example:<br /><code>john_doe@example.com</code>.
    ocsfv1.6.0filehostingactivityFileName:
      title: ocsfv1.6.0filehostingactivityFileName
      type: string
      description: File name. For example:<br /><code>text-file.txt</code>.
    ocsfv1.6.0filehostingactivityFilePath:
      title: ocsfv1.6.0filehostingactivityFilePath
      type: string
      description: >-
        The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.
    ocsfv1.6.0filehostingactivityHash:
      title: ocsfv1.6.0filehostingactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example:<br /> MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.6.0filehostingactivityHostname:
      title: ocsfv1.6.0filehostingactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. It may
        be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>
    ocsfv1.6.0filehostingactivityIPAddress:
      title: ocsfv1.6.0filehostingactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.6.0filehostingactivityMACAddress:
      title: ocsfv1.6.0filehostingactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.
    ocsfv1.6.0filehostingactivityPort:
      title: ocsfv1.6.0filehostingactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example:<br /><code>80</code>,<br
        /><code>22</code>.
    ocsfv1.6.0filehostingactivityProcessName:
      title: ocsfv1.6.0filehostingactivityProcessName
      type: string
      description: Process name. For example:<br /><code>Notepad</code>.
    ocsfv1.6.0filehostingactivitySubnet:
      title: ocsfv1.6.0filehostingactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>
    ocsfv1.6.0filehostingactivityTimestamp:
      title: ocsfv1.6.0filehostingactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example:<br /><code>1618524549901</code>.
    ocsfv1.6.0filehostingactivityURLString:
      title: ocsfv1.6.0filehostingactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.6.0filehostingactivityUserName:
      title: ocsfv1.6.0filehostingactivityUserName
      type: string
      description: User name. For example:<br /><code>john_doe</code>.
    ocsfv1.6.0filehostingactivityActionId:
      title: ocsfv1.6.0filehostingactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Custom
        Action', 'Challenge'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        3 - Observed: The activity was observed, but neither explicitly allowed
        nor denied. This is common with IDS and EDR controls that report
        additional information on observed behavior such as TTPs. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Logged', 'Alert', 'Detected',
        'Count', etc.

        4 - Modified: The activity was modified, adjusted, or corrected. The
        <code>disposition_id</code> attribute should be set appropriately, for
        example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.

        99 - Other: The action is not mapped. See the <code>action</code>
        attribute which contains a data source specific value.
    ocsfv1.6.0filehostingactivityActivityId:
      title: ocsfv1.6.0filehostingactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Upload: Upload a file.

        2 - Download: Download a file.

        3 - Update: Update a file.

        4 - Delete: Delete a file.

        5 - Rename: Rename a file.

        6 - Copy: Copy a file.

        7 - Move: Move a file.

        8 - Restore: Restore a file.

        9 - Preview: Preview a file.

        10 - Lock: Lock a file.

        11 - Unlock: Unlock a file.

        12 - Share: Share a file.

        13 - Unshare: Unshare a file.

        14 - Open: Open a file.

        15 - Sync: Mark a file or folder to sync with a computer.

        16 - Unsync: Mark a file or folder to not sync with a computer.

        17 - AccessCheck: Access check for a file. The
        <code>security_control</code> profile can be used to add the access
        check results.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityCategoryUid:
      title: ocsfv1.6.0filehostingactivityCategoryUid
      type: integer
      description: >-
        CategoryUid is an enum, and the following values are allowed.

        6 - ApplicationActivity: Application Activity events report detailed
        information about the behavior of applications and services.
    ocsfv1.6.0filehostingactivityClassUid:
      title: ocsfv1.6.0filehostingactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        6006 - FileHostingActivity: File Hosting Activity events report the
        actions taken by file management applications, including file sharing
        servers like Sharepoint and services such as Box, MS OneDrive, Google
        Drive, or network file share services.
    ocsfv1.6.0filehostingactivityConfidenceId:
      title: ocsfv1.6.0filehostingactivityConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityDispositionId:
      title: ocsfv1.6.0filehostingactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityFileHosting:
      title: ocsfv1.6.0filehostingactivityFileHosting
      type: object
      description: >-
        File Hosting Activity events report the actions taken by file management
        applications, including file sharing servers like Sharepoint and
        services such as Box, MS OneDrive, Google Drive, or network file share
        services.
      properties:
        access_list:
          type: array
          items:
            type: string
          nullable: true
          description: The list of requested access rights.
        access_mask:
          type: integer
          nullable: true
          description: The sum of hexadecimal values of requested access rights.
        access_result:
          nullable: true
          description: The list of access check results.
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. An unknown action may still correspond
            to a known disposition. Refer to <code>disposition_id</code> for the
            outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityActor'
          nullable: true
          description: The actor that performed the activity on the target file.
        api:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAttack'
          nullable: true
          description: >-
            An array of MITRE ATT&amp;CK® objects describing identified tactics,
            techniques &amp; sub-techniques. The objects are compatible with
            MITRE ATLAS™ tactics, techniques &amp; sub-techniques.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Application Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        connection_info:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkConnectionInfo
          nullable: true
          description: The network connection information.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityNetworkEndpoint'
          nullable: true
          description: The endpoint that received the activity on the target file.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The share expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The share expiration time.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          description: The file that is the target of the activity.
        file_result:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          nullable: true
          description: >-
            The resulting file object when the activity was allowed and
            successful.
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFirewallRule'
          nullable: true
          description: >-
            The firewall rule that pertains to the control that triggered the
            event, if applicable.
        http_request:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHttpRequest'
          nullable: true
          description: Details about the underlying HTTP request.
        http_response:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHttpResponse'
          nullable: true
          description: Details about the HTTP response, if available.
        is_alert:
          type: boolean
          nullable: true
          description: >-
            Indicates that the event is considered to be an alertable signal.
            Should be set to <code>true</code> if <code>disposition_id =
            Alert</code> among other dispositions, and/or
            <code>risk_level_id</code> or <code>severity_id</code> of the event
            is elevated. Not all control events will be alertable, for example
            if <code>disposition_id = Exonerated</code> or <code>disposition_id
            = Allowed</code>.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        malware_scan_info:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMalwareScanInfo'
          nullable: true
          description: >-
            Describes details about the scan job that identified malware on the
            target system.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPolicy'
          nullable: true
          description: >-
            The policy that pertains to the control that triggered the event, if
            applicable. For example the name of an anti-malware policy or an
            access control policy.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        raw_data_hash:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: The hash, which describes the content of the raw_data field.
        raw_data_size:
          type: integer
          nullable: true
          description: >-
            The size of the raw data which was transformed into an OCSF event,
            in bytes.
        risk_details:
          type: string
          nullable: true
          description: Describes the risk associated with the finding.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityRiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            <code>severity_id</code> value. In the case of 'Other', it is
            defined by the source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        share:
          type: string
          nullable: true
          description: The share name.
        share_type:
          type: string
          nullable: true
          description: >-
            The share type, normalized to the caption of the share_type_id
            value. In the case of 'Other', it is defined by the event source.
        share_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityShareTypeId'
          nullable: true
          description: The normalized identifier of the share type.
        sharing:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySharing'
          nullable: true
          description: >-
            Information about how and with whom a resource was shared, such as
            sharing permissions and scope.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityNetworkEndpoint'
          description: The endpoint that performed the activity on the target file.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - file
        - metadata
        - severity_id
        - src_endpoint
        - time
        - type_uid
    ocsfv1.6.0filehostingactivityRiskLevelId:
      title: ocsfv1.6.0filehostingactivityRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivitySeverityId:
      title: ocsfv1.6.0filehostingactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityShareTypeId:
      title: ocsfv1.6.0filehostingactivityShareTypeId
      type: integer
      description: >-
        ShareTypeId is an enum, and the following values are allowed.

        0 - Unknown: The share type is unknown.

        1 - File

        2 - Pipe

        3 - Print

        99 - Other: The share type is not mapped. See the
        <code>share_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityStatusId:
      title: ocsfv1.6.0filehostingactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityTypeUid:
      title: ocsfv1.6.0filehostingactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        600600 - Unknown

        600601 - Upload: Upload a file.

        600602 - Download: Download a file.

        600603 - Update: Update a file.

        600604 - Delete: Delete a file.

        600605 - Rename: Rename a file.

        600606 - Copy: Copy a file.

        600607 - Move: Move a file.

        600608 - Restore: Restore a file.

        600609 - Preview: Preview a file.

        600610 - Lock: Lock a file.

        600611 - Unlock: Unlock a file.

        600612 - Share: Share a file.

        600613 - Unshare: Unshare a file.

        600614 - Open: Open a file.

        600615 - Sync: Mark a file or folder to sync with a computer.

        600616 - Unsync: Mark a file or folder to not sync with a computer.

        600617 - AccessCheck: Access check for a file. The
        <code>security_control</code> profile can be used to add the access
        check results.

        600699 - Other
    ocsfv1.6.0filehostingactivityAccount:
      title: ocsfv1.6.0filehostingactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
        Additionally, the Account object refers to logical Cloud and
        Software-as-a-Service (SaaS) based containers such as AWS Accounts,
        Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects,
        and otherwise.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the account.
        name:
          type: string
          nullable: true
          description: >-
            The name of the account (e.g. <code> GCP Project name </code>,
            <code> Linux Account name </code> or <code> AWS Account
            name</code>).
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            account.
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the account (e.g. <code> AWS Account ID
            </code>, <code> OCID </code>, <code> GCP Project ID </code>, <code>
            Azure Subscription ID </code>, <code> Google Workspace Customer ID
            </code>, or <code> M365 Tenant UID</code>).
    ocsfv1.6.0filehostingactivityAccount_TypeId:
      title: ocsfv1.6.0filehostingactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        11 - GCPProject
        12 - OCICompartment
        13 - AzureSubscription
        14 - SalesforceAccount
        15 - GoogleWorkspace
        16 - ServicenowInstance
        17 - M365Tenant
        18 - EmailAccount
        99 - Other: The account type is not mapped.
    ocsfv1.6.0filehostingactivityActor:
      title: ocsfv1.6.0filehostingactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
        Note that Actor is not the threat actor of a campaign but may be part of
        a campaign.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.6.0filehostingactivityActor_ActorTypeId:
      title: ocsfv1.6.0filehostingactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityAdvisory:
      title: ocsfv1.6.0filehostingactivityAdvisory
      type: object
      description: >-
        The Advisory object represents publicly disclosed cybersecurity
        vulnerabilities defined in a Security advisory. e.g. <code> Microsoft KB
        Article</code>, <code>Apple Security Advisory</code>, or a <code>GitHub
        Security Advisory (GHSA)</code>
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The Advisory bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the Advisory.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the Advisory record was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was created.
        desc:
          type: string
          nullable: true
          description: A brief description of the Advisory Record.
        install_state:
          type: string
          nullable: true
          description: The install state of the Advisory.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityAdvisory_InstallStateId
          nullable: true
          description: The normalized install state ID of the Advisory.
        is_superseded:
          type: boolean
          nullable: true
          description: The Advisory has been replaced by another.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the Advisory record was last updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was last updated.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOs'
          nullable: true
          description: The operating system the Advisory applies to.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerabilities disclosed in the Advisory.
        related_cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCve'
          nullable: true
          description: >-
            A list of Common Vulnerabilities and Exposures <a target="_blank"
            href="https://cve.mitre.org/">(CVE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCwe'
          nullable: true
          description: >-
            A list of Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        size:
          type: integer
          nullable: true
          description: >-
            The size in bytes for the Advisory. Usually populated for a KB
            Article patch.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: The Advisory link from the source vendor.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the Advisory.
        uid:
          type: string
          description: >-
            The unique identifier assigned to the advisory or disclosed
            vulnerability, e.g, <code>GHSA-5mrr-rgp6-x4gr</code>.
      required:
        - uid
    ocsfv1.6.0filehostingactivityAdvisory_InstallStateId:
      title: ocsfv1.6.0filehostingactivityAdvisory_InstallStateId
      type: integer
      description: >-
        AdvisoryInstallStateId is an enum, and the following values are allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityAffectedCode:
      title: ocsfv1.6.0filehostingactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_column:
          type: integer
          nullable: true
          description: >-
            The column number of the last part of the assessed code identified
            as vulnerable.
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        rule:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityRule'
          nullable: true
          description: >-
            Details about the specific rule, e.g., those defined as part of a
            larger <code>policy</code>, that triggered the finding.
        start_column:
          type: integer
          nullable: true
          description: >-
            The column number of the first part of the assessed code identified
            as vulnerable.
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.6.0filehostingactivityAffectedPackage:
      title: ocsfv1.6.0filehostingactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        path:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFilePath'
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityAffectedPackage_TypeId
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.6.0filehostingactivityAffectedPackage_TypeId:
      title: ocsfv1.6.0filehostingactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityAgent:
      title: ocsfv1.6.0filehostingactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.6.0filehostingactivityAgent_TypeId:
      title: ocsfv1.6.0filehostingactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityAnalytic:
      title: ocsfv1.6.0filehostingactivityAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The algorithm used by the underlying analytic to generate the
            finding.
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: Other analytics related to this analytic.
        state:
          type: string
          nullable: true
          description: The Analytic state.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAnalytic_StateId'
          nullable: true
          description: The Analytic state identifier.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.6.0filehostingactivityAnalytic_StateId:
      title: ocsfv1.6.0filehostingactivityAnalytic_StateId
      type: integer
      description: >-
        AnalyticStateId is an enum, and the following values are allowed.

        0 - Unknown: The state is unknown.

        1 - Active: The Analytic is active.

        2 - Suppressed: The Analytic is suppressed. For example, a user/customer
        has suppressed a particular detection signature in a security product.

        3 - Experimental: The Analytic is still under development and considered
        experimental.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityAnalytic_TypeId:
      title: ocsfv1.6.0filehostingactivityAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityApi:
      title: ocsfv1.6.0filehostingactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.6.0filehostingactivityAttack:
      title: ocsfv1.6.0filehostingactivityAttack
      type: object
      description: >-
        The MITRE ATT&amp;CK® &amp; ATLAS™ object describes the tactic,
        technique, sub-technique &amp; mitigation associated to an attack.
      properties:
        mitigation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMitigation'
          nullable: true
          description: >-
            The Mitigation object describes the MITRE ATT&CK® or ATLAS™
            Mitigation ID and/or name that is associated to an attack.
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySubTechnique'
          nullable: true
          description: >-
            The Sub-technique object describes the MITRE ATT&CK® or ATLAS™
            Sub-technique ID and/or name associated to an attack.
        tactic:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID
            and/or name that is associated to an attack.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique
            ID and/or name associated to an attack.
        version:
          type: string
          nullable: true
          description: The ATT&amp;CK® or ATLAS™ Matrix version.
    ocsfv1.6.0filehostingactivityAuthFactor:
      title: ocsfv1.6.0filehostingactivityAuthFactor
      type: object
      description: >-
        An Authentication Factor object describes a category of methods used for
        identity verification in an authentication attempt.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDevice'
          nullable: true
          description: Device used to complete an authentication request.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The email address used in an email-based authentication factor.
        factor_type:
          type: string
          nullable: true
          description: The type of authentication factor used in an authentication attempt.
        factor_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityAuthFactor_FactorTypeId
          description: The normalized identifier for the authentication factor.
        is_hotp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is an HMAC-based One-time Password
            (HOTP).
        is_totp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is a Time-based One-time Password
            (TOTP).
        phone_number:
          type: string
          nullable: true
          description: The phone number used for a telephony-based authentication request.
        provider:
          type: string
          nullable: true
          description: The name of provider for an authentication factor.
        security_questions:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The question(s) provided to user for a question-based authentication
            factor.
      required:
        - factor_type_id
    ocsfv1.6.0filehostingactivityAuthFactor_FactorTypeId:
      title: ocsfv1.6.0filehostingactivityAuthFactor_FactorTypeId
      type: integer
      description: >-
        AuthFactorFactorTypeId is an enum, and the following values are allowed.

        0 - Unknown

        1 - SMS: User receives and inputs a code sent to their mobile device via
        SMS text message.

        2 - SecurityQuestion: The user responds to a security question as part
        of a question-based authentication factor

        3 - PhoneCall: System calls the user's registered phone number and
        requires the user to answer and provide a response.

        4 - Biometric: Devices that verify identity-based on user's physical
        identifiers, such as fingerprint scanners or retina scanners.

        5 - PushNotification: Push notification is sent to user's registered
        device and requires the user to acknowledge.

        6 - HardwareToken: Physical device that generates a code to be used for
        authentication.

        7 - OTP: Application generates a one-time password (OTP) for use in
        authentication.

        8 - Email: A code or link is sent to a user's registered email address.

        9 - U2F: Typically involves a hardware token, which the user physically
        interacts with to authenticate.

        10 - WebAuthn: Web-based API that enables users to register devices as
        authentication factors.

        11 - Password: The user enters a password that they have previously
        established.

        99 - Other
    ocsfv1.6.0filehostingactivityAuthorization:
      title: ocsfv1.6.0filehostingactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.6.0filehostingactivityAutonomousSystem:
      title: ocsfv1.6.0filehostingactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.6.0filehostingactivityCampaign:
      title: ocsfv1.6.0filehostingactivityCampaign
      type: object
      description: >-
        Campaign represent organized efforts by threat actors to achieve
        malicious objectives over a period, often characterized by shared
        tactics, techniques, and procedures (TTPs).
      properties:
        name:
          type: string
          description: The name of a specific campaign associated with a cyber threat.
      required:
        - name
    ocsfv1.6.0filehostingactivityCertificate:
      title: ocsfv1.6.0filehostingactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - issuer
        - serial_number
    ocsfv1.6.0filehostingactivityCisControl:
      title: ocsfv1.6.0filehostingactivityCisControl
      type: object
      description: >-
        The CIS Control (aka Critical Security Control) object describes a
        prioritized set of actions to protect your organization and data from
        cyber-attack vectors. The <a target="_blank"
        href="https://www.cisecurity.org/controls">CIS Controls</a> are defined
        by the Center for Internet Security.
      properties:
        desc:
          type: string
          nullable: true
          description: >-
            The CIS Control description. For example: <i>Uninstall or disable
            unnecessary services on enterprise assets and software, such as an
            unused file sharing service, web application module, or service
            function.</i>
        name:
          type: string
          description: >-
            The CIS Control name. For example: <i>4.8 Uninstall or Disable
            Unnecessary Services on Enterprise Assets and Software.</i>
        version:
          type: string
          nullable: true
          description: 'The CIS Control version. For example: <i>v8</i>.'
      required:
        - name
    ocsfv1.6.0filehostingactivityCloud:
      title: ocsfv1.6.0filehostingactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud or
        Software-as-a-Service account or similar construct, such as AWS Account
        ID, regions, organizations, folders, compartments, tenants, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        org:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.6.0filehostingactivityContainer:
      title: ocsfv1.6.0filehostingactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            container.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.6.0filehostingactivityCve:
      title: ocsfv1.6.0filehostingactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> details related to the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.6.0filehostingactivityCvss:
      title: ocsfv1.6.0filehostingactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The source URL for the CVSS score. For example:
            <code>https://nvd.nist.gov/vuln/detail/CVE-2021-44228</code>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor that provided the CVSS score. For example: <code>NVD,
            REDHAT</code> etc.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.6.0filehostingactivityCvss_Depth:
      title: ocsfv1.6.0filehostingactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.6.0filehostingactivityCwe:
      title: ocsfv1.6.0filehostingactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.6.0filehostingactivityD3fTactic:
      title: ocsfv1.6.0filehostingactivityD3fTactic
      type: object
      description: >-
        The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that
        is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the defensive technique. For
            example: <code>Isolate</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the defensive tactic. For example:
            <code>https://d3fend.mitre.org/tactic/d3f:Isolate/</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the defensive tactic.
    ocsfv1.6.0filehostingactivityD3fTechnique:
      title: ocsfv1.6.0filehostingactivityD3fTechnique
      type: object
      description: >-
        The MITRE D3FEND™ Technique object describes the leaf defensive
        technique ID and/or name associated to a countermeasure.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the defensive technique. For example: <code>IO Port
            Restriction</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the defensive technique. For example:
            <code>https://d3fend.mitre.org/technique/d3f:IOPortRestriction/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the defensive technique. For example:
            <code>D3-IOPR</code>.
    ocsfv1.6.0filehostingactivityD3fend:
      title: ocsfv1.6.0filehostingactivityD3fend
      type: object
      description: >-
        The MITRE D3FEND™ object describes the tactic &amp; technique associated
        with a countermeasure.
      properties:
        d3f_tactic:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityD3fTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated with a countermeasure.
        d3f_technique:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityD3fTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated with a countermeasure.
        version:
          type: string
          nullable: true
          description: The D3FEND™ Matrix version.
    ocsfv1.6.0filehostingactivityDevice:
      title: ocsfv1.6.0filehostingactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        boot_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier of the device that changes after every reboot.
            For example, the value of
            <code>/proc/sys/kernel/random/boot_id</code> from Linux's procfs.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        eid:
          type: string
          nullable: true
          description: >-
            An Embedded Identity Document, is a unique serial number that
            identifies an eSIM-enabled device.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        iccid:
          type: string
          nullable: true
          description: >-
            The Integrated Circuit Card Identification of a mobile device.
            Typically it is a unique 18 to 22 digit number that identifies a SIM
            card.
        image:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity that is associated with
            the device.
        imei_list:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity values that are
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_backed_up:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device or resource has a backup enabled, such
            as an automated snapshot or a cloud backup. For example, this is
            indicated by the <code>cloudBackupEnabled</code> value within JAMF
            Pro mobile devices or the registration of an AWS ARN with the AWS
            Backup service.
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_mobile_account_active:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device has an active mobile account. For
            example, this is indicated by the
            <code>itunesStoreAccountActive</code> value within JAMF Pro mobile
            devices.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_shared:
          type: boolean
          nullable: true
          description: The event occurred on a shared device.
        is_supervised:
          type: boolean
          nullable: true
          description: >-
            The event occurred on a supervised device. Devices that are
            supervised are typically mobile devices managed by a Mobile Device
            Management solution and are restricted from specific behaviors such
            as Apple AirDrop.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        meid:
          type: string
          nullable: true
          description: >-
            The Mobile Equipment Identifier. It's a unique number that
            identifies a Code Division Multiple Access (CDMA) mobile device.
        model:
          type: string
          nullable: true
          description: >-
            The model of the device. For example <code>ThinkPad X1
            Carbon</code>.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityNetworkInterface'
          nullable: true
          description: >-
            The physical or virtual network interfaces that are associated with
            the device, one for each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityDevice_NetworkStatusId
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOs'
          nullable: true
          description: The endpoint operating system.
        os_machine_uuid:
          type: string
          nullable: true
          description: >-
            The operating system assigned Machine ID. In Windows, this is the
            value stored at the registry path:
            <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid</code>.
            In Linux, this is stored in the file: <code>/etc/machine-id</code>.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDevice_TypeId'
          description: The device type ID.
        udid:
          type: string
          nullable: true
          description: >-
            The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS,
            tvOS, watchOS and visionOS devices, this is the UDID. For macOS
            devices, it is the Provisioning UDID. For example:
            <code>00008020-008D4548007B4F26</code>
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor for the device. For example <code>Dell</code> or
            <code>Lenovo</code>.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.6.0filehostingactivityDevice_NetworkStatusId:
      title: ocsfv1.6.0filehostingactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.6.0filehostingactivityDevice_RiskLevelId:
      title: ocsfv1.6.0filehostingactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityDevice_TypeId:
      title: ocsfv1.6.0filehostingactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityDeviceHwInfo:
      title: ocsfv1.6.0filehostingactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_architecture:
          type: string
          nullable: true
          description: >-
            The CPU architecture, normalized to the caption of the
            <code>cpu_architecture_id</code> value. In the case of
            <code>Other</code>, it is defined by the source.
        cpu_architecture_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityDeviceHwInfo_CpuArchitectureId
          nullable: true
          description: The normalized identifier of the CPU architecture.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
        uuid:
          type: string
          nullable: true
          description: >-
            The device manufacturer assigned universally unique hardware
            identifier. For SMBIOS compatible devices such as those running
            Linux and Windows, it is the UUID member of the System Information
            structure in the SMBIOS information. For macOS devices, it is the
            Hardware UUID (also known as IOPlatformUUID in the I/O Registry).
        vendor_name:
          type: string
          nullable: true
          description: The device manufacturer.
    ocsfv1.6.0filehostingactivityDeviceHwInfo_CpuArchitectureId:
      title: ocsfv1.6.0filehostingactivityDeviceHwInfo_CpuArchitectureId
      type: integer
      description: >-
        DeviceHwInfoCpuArchitectureId is an enum, and the following values are
        allowed.

        0 - Unknown: The CPU architecture is unknown.

        1 - x86: CPU uses the x86 ISA. For bitness, refer to
        <code>cpu_bits</code>.

        2 - ARM: CPU uses the ARM ISA. For bitness, refer to
        <code>cpu_bits</code>.

        3 - V: CPU uses the RISC-V ISA. For bitness, refer to
        <code>cpu_bits</code>.

        99 - Other: The CPU architecture is not mapped. See the
        <code>cpu_architecture</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityDigitalSignature:
      title: ocsfv1.6.0filehostingactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityDigitalSignature_StateId
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.6.0filehostingactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.6.0filehostingactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityDigitalSignature_StateId:
      title: ocsfv1.6.0filehostingactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityDisplay:
      title: ocsfv1.6.0filehostingactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.6.0filehostingactivityDnsAnswer:
      title: ocsfv1.6.0filehostingactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0filehostingactivityDnsAnswer_FlagIds
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.6.0filehostingactivityDnsAnswer_FlagIds:
      title: ocsfv1.6.0filehostingactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityDomainContact:
      title: ocsfv1.6.0filehostingactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityDomainContact_TypeId
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.6.0filehostingactivityDomainContact_TypeId:
      title: ocsfv1.6.0filehostingactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityEmail:
      title: ocsfv1.6.0filehostingactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction, and can include embedded URLs and files.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Cc values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>.
        cc_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Cc Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            field. For example <code>example.user@usersdomain.com</code>
        delivered_to_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            values. For example <code>example.user@usersdomain.com</code>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          nullable: true
          description: The files embedded or attached to the email.
        from:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header From value, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>.
        from_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header From values. This array should
            contain the value in <code>from</code>. For example
            <code>example.user@usersdomain.com</code>.
        from_mailbox:
          type: string
          nullable: true
          description: >-
            The human-readable email header From Mailbox value. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        from_mailboxes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The human-readable email header From Mailbox values. This array
            should contain the value in <code>from_mailbox</code>. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        is_read:
          type: boolean
          nullable: true
          description: The indication of whether the email has been read.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-ID value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Reply-To value, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Reply-To values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Reply To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        return_path:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The address found in the 'Return-Path' header, which indicates where
            bounce messages (non-delivery reports) should be sent. This address
            is often set by the sending system and may differ from the 'From' or
            'Sender' addresses. For example,
            <code>mailer-daemon@senderserver.com</code>.
        sender:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine readable email address of the system or server that
            actually transmitted the email message, extracted from the email
            headers per RFC 5322. This differs from the <code>from</code> field,
            which shows the message author. The sender field is most commonly
            used when multiple addresses appear in the <code> from_list </code>
            field, or when the transmitting system is different from the message
            author (such as when sending on behalf of someone else).
        sender_mailbox:
          type: string
          nullable: true
          description: >-
            The human readable email address of the system or server that
            actually transmitted the email message, extracted from the email
            headers per RFC 5322. This differs from the
            <code>from_mailbox</code> field, which shows the message author. The
            sender mailbox field is most commonly used when multiple addresses
            appear in the <code> from_mailboxes </code> field, or when the
            transmitting system is different from the message author (such as
            when sending on behalf of someone else).
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header To values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>
        to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the email thread.
        urls:
          type: array
          items:
            type: string
          nullable: true
          description: The URLs embedded in the email.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
    ocsfv1.6.0filehostingactivityEmailAuth:
      title: ocsfv1.6.0filehostingactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.6.0filehostingactivityEncryptionDetails:
      title: ocsfv1.6.0filehostingactivityEncryptionDetails
      type: object
      description: Details about the encryption methodology utilized.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The encryption algorithm used, normalized to the caption of
            'algorithm_id
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityEncryptionDetails_AlgorithmId
          nullable: true
          description: The encryption algorithm used.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key used.
        key_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the key used for encryption. For example,
            AWS KMS Key ARN.
        type:
          type: string
          nullable: true
          description: The type of the encryption used.
    ocsfv1.6.0filehostingactivityEncryptionDetails_AlgorithmId:
      title: ocsfv1.6.0filehostingactivityEncryptionDetails_AlgorithmId
      type: integer
      description: >-
        EncryptionDetailsAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DES: Data Encryption Standard Algorithm

        2 - TripleDES: Triple Data Encryption Standard Algorithm

        3 - AES: Advanced Encryption Standard Algorithm.

        4 - RSA: Rivest-Shamir-Adleman Algorithm

        5 - ECC: Elliptic Curve Cryptography Algorithm

        6 - SM2: ShangMi Cryptographic Algorithm

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityEnrichment:
      title: ocsfv1.6.0filehostingactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.6.0filehostingactivityEnvironmentVariable:
      title: ocsfv1.6.0filehostingactivityEnvironmentVariable
      type: object
      description: An environment variable.
      properties:
        name:
          type: string
          description: The name of the environment variable.
        value:
          type: string
          description: The value of the environment variable.
      required:
        - name
        - value
    ocsfv1.6.0filehostingactivityEpss:
      title: ocsfv1.6.0filehostingactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.6.0filehostingactivityExtension:
      title: ocsfv1.6.0filehostingactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.6.0filehostingactivityFeature:
      title: ocsfv1.6.0filehostingactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.6.0filehostingactivityFile:
      title: ocsfv1.6.0filehostingactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityFile_ConfidentialityId
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        drive_type:
          type: string
          nullable: true
          description: >-
            The drive type, normalized to the caption of the
            <code>drive_type_id</code> value. In the case of <code>Other</code>,
            it is defined by the source.
        drive_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile_DriveTypeId'
          nullable: true
          description: Identifies the type of a disk drive, i.e. fixed, removable, etc.
        encryption_details:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEncryptionDetails'
          nullable: true
          description: >-
            The encryption details of the file. Should be populated if the file
            is encrypted.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        internal_name:
          type: string
          nullable: true
          description: >-
            The name of the file as identified within the file itself. This
            contrasts with the name by which the file is known on disk. Where
            available, the internal name is widely used by security
            practitioners and detection content because the on-disk file name is
            not reliable. On the Windows OS, most PE files contain a <a
            href="https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource">VERSIONINFO</a>
            resource from which the internal name can be obtained. On macOS,
            binaries can optionally embed a copy of the application's Info.plist
            file which in turn contains the name of the executable.
        is_deleted:
          type: boolean
          nullable: true
          description: Indicates if the file was deleted from the filesystem.
        is_encrypted:
          type: boolean
          nullable: true
          description: Indicates if the file is encrypted.
        is_public:
          type: boolean
          nullable: true
          description: >-
            Indicates if the file is publicly accessible. For example in an
            object's public access in AWS S3
        is_readonly:
          type: boolean
          nullable: true
          description: Indicates that the file cannot be modified.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFilePath'
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        storage_class:
          type: string
          nullable: true
          description: >-
            The storage class of the file. For example in AWS S3:
            <code>STANDARD, STANDARD_IA, GLACIER</code>.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            file.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile_TypeId'
          description: >-
            The file type ID. Note the distinction between a <code>Regular
            File</code> and an <code>Executable File</code>. If the distinction
            is not known, or not indicated by the log, use <code>Regular
            File</code>. In this case, it should not be assumed that a Regular
            File is not executable.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        uri:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The file URI, such as those reporting by static analysis tools.
            E.g.,
            <code>file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js</code>
        url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUrl'
          nullable: true
          description: The URL of the file, when applicable.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        volume:
          type: string
          nullable: true
          description: The volume on the storage device where the file is located.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.6.0filehostingactivityFile_ConfidentialityId:
      title: ocsfv1.6.0filehostingactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityFile_DriveTypeId:
      title: ocsfv1.6.0filehostingactivityFile_DriveTypeId
      type: integer
      description: >-
        FileDriveTypeId is an enum, and the following values are allowed.

        0 - Unknown: The drive type is unknown.

        1 - Removable: The drive has removable media; for example, a floppy
        drive, thumb drive, or flash card reader.

        2 - Fixed: The drive has fixed media; for example, a hard disk drive or
        flash drive.

        3 - Remote: The drive is a remote (network) drive.

        4 - ROM: The drive is a CD-ROM drive.

        5 - RAMDisk: The drive is a RAM disk.

        99 - Other: The drive type is not mapped. See the
        <code>drive_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityFile_TypeId:
      title: ocsfv1.6.0filehostingactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        8 - ExecutableFile

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityFingerprint:
      title: ocsfv1.6.0filehostingactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of <code>algorithm_id</code>. In the case
            of <code>Other</code>, it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityFingerprint_AlgorithmId
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.6.0filehostingactivityFingerprint_AlgorithmId:
      title: ocsfv1.6.0filehostingactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        8 - 224: Secure Hash Algorithm 2 producing a 224-bit (28-byte) hash
        value.

        9 - 384: Secure Hash Algorithm 2 producing a 384-bit (48-byte) hash
        value.

        10 - 512_224: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value truncated to a 224-bit (28-byte) hash value.

        11 - 512_256: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value truncated to a 256-bit (32-byte) hash value.

        12 - 224: Secure Hash Algorithm 3 producing a 224-bit (28-byte) hash
        value.

        13 - 256: Secure Hash Algorithm 3 producing a 256-bit (32-byte) hash
        value.

        14 - 384: Secure Hash Algorithm 3 producing a 384-bit (48-byte) hash
        value.

        15 - 512: Secure Hash Algorithm 3 producing a 512-bit (64-byte) hash
        value.

        16 - bit: xxHash H3 producing a 64-bit hash value.

        17 - bit: xxHash H3 producing a 128-bit hash value.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityFirewallRule:
      title: ocsfv1.6.0filehostingactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.6.0filehostingactivityGroup:
      title: ocsfv1.6.0filehostingactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization, including but not
        limited to purposes of access control.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.6.0filehostingactivityHttpHeader:
      title: ocsfv1.6.0filehostingactivityHttpHeader
      type: object
      description: >-
        The HTTP Header object represents the headers sent in an HTTP request or
        response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the HTTP header.
        value:
          type: string
          description: The value of the HTTP header.
      required:
        - name
        - value
    ocsfv1.6.0filehostingactivityHttpRequest:
      title: ocsfv1.6.0filehostingactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        body_length:
          type: integer
          nullable: true
          description: >-
            The actual length of the HTTP request body, in number of bytes,
            independent of a potentially existing Content-Length header.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityHttpRequest_HttpMethod
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The length of the entire HTTP request, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.6.0filehostingactivityHttpRequest_HttpMethod:
      title: ocsfv1.6.0filehostingactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        PATCH - Patch: The PATCH method applies partial modifications to a
        resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.6.0filehostingactivityHttpResponse:
      title: ocsfv1.6.0filehostingactivityHttpResponse
      type: object
      description: >-
        The HTTP Response object contains detailed information about the
        response sent from a web server to the requester. It encompasses
        attributes and metadata that describe the response status, headers, body
        content, and other relevant information.
      properties:
        body_length:
          type: integer
          nullable: true
          description: >-
            The actual length of the HTTP response body, in number of bytes,
            independent of a potentially existing Content-Length header.
        code:
          type: integer
          description: >-
            The Hypertext Transfer Protocol (HTTP) status code returned from the
            web server to the client. For example, 200.
        content_type:
          type: string
          nullable: true
          description: >-
            The request header that identifies the original <a target="_blank"
            href="https://www.iana.org/assignments/media-types/media-types.xhtml">media
            type </a> of the resource (prior to any content encoding applied for
            sending).
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        latency:
          type: integer
          nullable: true
          description: The HTTP response latency measured in milliseconds.
        length:
          type: integer
          nullable: true
          description: The length of the entire HTTP response, in number of bytes.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        status:
          type: string
          nullable: true
          description: >-
            The response status. For example: A successful HTTP status of 'OK'
            which corresponds to a code of 200.
      required:
        - code
    ocsfv1.6.0filehostingactivityIdp:
      title: ocsfv1.6.0filehostingactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        auth_factors:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAuthFactor'
          nullable: true
          description: >-
            The Authentication Factors object describes the different types of
            Multi-Factor Authentication (MFA) methods and/or devices supported
            by the Identity Provider.
        domain:
          type: string
          nullable: true
          description: The primary domain associated with the Identity Provider.
        fingerprint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: >-
            The fingerprint of the X.509 certificate used by the Identity
            Provider.
        has_mfa:
          type: boolean
          nullable: true
          description: The Identity Provider enforces Multi Factor Authentication (MFA).
        issuer:
          type: string
          nullable: true
          description: >-
            The unique identifier (often a URL) used by the Identity Provider as
            its issuer.
        name:
          type: string
          nullable: true
          description: The name of the Identity Provider.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol of the Identity Provider. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        scim:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityScim'
          nullable: true
          description: >-
            The System for Cross-domain Identity Management (SCIM) resource
            object provides a structured set of attributes related to SCIM
            protocols used for identity provisioning and management across
            cloud-based platforms. It standardizes user and group provisioning
            details, enabling identity synchronization and lifecycle management
            with compatible Identity Providers (IdPs) and applications. SCIM is
            defined in <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc7643'>RFC-7634</a>
        sso:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySso'
          nullable: true
          description: >-
            The Single Sign-On (SSO) object provides a structure for normalizing
            SSO attributes, configuration, and/or settings from Identity
            Providers.
        state:
          type: string
          nullable: true
          description: >-
            The configuration state of the Identity Provider, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIdp_StateId'
          nullable: true
          description: >-
            The normalized state ID of the Identity Provider to reflect its
            configuration or activation status.
        tenant_uid:
          type: string
          nullable: true
          description: The tenant ID associated with the Identity Provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the Identity Provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The URL for accessing the configuration or metadata of the Identity
            Provider.
    ocsfv1.6.0filehostingactivityIdp_StateId:
      title: ocsfv1.6.0filehostingactivityIdp_StateId
      type: integer
      description: >-
        IdpStateId is an enum, and the following values are allowed.

        0 - Unknown: The configuration state of the Identity Provider is
        unknown.

        1 - Active: The Identity Provider is in an Active state, or otherwise
        enabled.

        2 - Suspended: The Identity Provider is in a Suspended state.

        3 - Deprecated: The Identity Provider is in a Deprecated state, or is
        otherwise disabled.

        4 - Deleted: The Identity Provider is in a Deleted state.

        99 - Other: The configuration state of the Identity Provider is not
        mapped. See the <code>state</code> attribute, which contains a data
        source specific value.
    ocsfv1.6.0filehostingactivityImage:
      title: ocsfv1.6.0filehostingactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the image.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFilePath'
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            image.
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.6.0filehostingactivityKbArticle:
      title: ocsfv1.6.0filehostingactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityKbArticle_InstallStateId
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the kb article.
    ocsfv1.6.0filehostingactivityKbArticle_InstallStateId:
      title: ocsfv1.6.0filehostingactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityKeyValueObject:
      title: ocsfv1.6.0filehostingactivityKeyValueObject
      type: object
      description: A generic object allowing to define a <code>{key:value}</code> pair.
      properties:
        name:
          type: string
          description: The name of the key.
        value:
          type: string
          nullable: true
          description: The value associated to the key.
        values:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Optional, the values associated to the key. You can populate this
            attribute, when you have multiple values for the same key.
      required:
        - name
    ocsfv1.6.0filehostingactivityKeyboardInfo:
      title: ocsfv1.6.0filehostingactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.6.0filehostingactivityKillChainPhase:
      title: ocsfv1.6.0filehostingactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityKillChainPhase_PhaseId
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.6.0filehostingactivityKillChainPhase_PhaseId:
      title: ocsfv1.6.0filehostingactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityLdapPerson:
      title: ocsfv1.6.0filehostingactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        display_name:
          type: string
          nullable: true
          description: >-
            The display name of the LDAP person. According to RFC 2798, this is
            the preferred name of a person to be used when displaying entries.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        phone_number:
          type: string
          nullable: true
          description: >-
            The telephone number of the user. Corresponds to the LDAP
            <code>Telephone-Number</code> CN.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            user.
    ocsfv1.6.0filehostingactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.6.0filehostingactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityLocation:
      title: ocsfv1.6.0filehostingactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address.
      properties:
        aerial_height:
          type: string
          nullable: true
          description: >-
            Expressed as either height above takeoff location or height above
            ground level (AGL) for a UAS current location. This value is
            provided in meters and must have a minimum resolution of 1 m.
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code.<p><b>Note:</b> The two letter
            country code should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geodetic_altitude:
          type: string
          nullable: true
          description: >-
            The aircraft distance above or below the ellipsoid as measured along
            a line that passes through the aircraft and is normal to the surface
            of the WGS-84 ellipsoid. This value is provided in meters and must
            have a minimum resolution of 1 m. Special Values:
            <code>Invalid</code>, <code>No Value</code>, or <code>Unknown: -1000
            m</code>.
        geodetic_vertical_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on geodetic altitude. This is based on
            ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        horizontal_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on horizontal position. This is based
            on ADS-B NACp. Measured in meters.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        pressure_altitude:
          type: string
          nullable: true
          description: >-
            The uncorrected barometric pressure altitude (based on reference
            standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms
            that utilize 'altitude deltas' between aircraft. This value is
            provided in meters and must have a minimum resolution of 1 m..
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. For example, 'CH-VD' for
            the Canton of Vaud, Switzerland
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.6.0filehostingactivityLogger:
      title: ocsfv1.6.0filehostingactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDevice'
          nullable: true
          description: The device where the events are logged.
        event_uid:
          type: string
          nullable: true
          description: The unique identifier of the event assigned by the logger.
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the OCSF event data has been truncated due to size
            limitations. When <code>true</code>, some event data may have been
            omitted to fit within system constraints.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The original size of the OCSF event data in kilobytes before any
            truncation occurred. This field is typically populated when
            <code>is_truncated</code> is <code>true</code> to indicate the full
            size of the original event.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.6.0filehostingactivityLongString:
      title: ocsfv1.6.0filehostingactivityLongString
      type: object
      description: >-
        This object is a used to capture strings which may be truncated by a
        security product due to their length.
      properties:
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates that <code>value</code> has been truncated. May be omitted
            if truncation has not occurred.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The size in bytes of the string represented by <code>value</code>
            before truncation. Should be omitted if truncation has not occurred.
        value:
          type: string
          description: >-
            The string value, truncated if <code>is_truncated</code> is
            <code>true</code>.
      required:
        - value
    ocsfv1.6.0filehostingactivityMalware:
      title: ocsfv1.6.0filehostingactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0filehostingactivityMalware_ClassificationIds
          description: The list of normalized identifiers of the malware classifications.
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCve'
          nullable: true
          description: >-
            The list of Common Vulnerabilities and Exposures (CVE) identifiers
            associated with the malware. Reference: <a target="_blank"
            href="https://cve.mitre.org/">CVE</a>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          nullable: true
          description: >-
            The list of file objects representing files that were identified as
            infected by the malware.
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The number of files that were identified to be infected by the
            malware.
        path:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFilePath'
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: >-
            The name or identifier of the security solution or service that
            provided the malware detection information.
        severity:
          type: string
          nullable: true
          description: >-
            The severity of the malware, normalized to the captions of the
            <code>severity_id</code> values. In the case of 'Other', they are
            defined by the event source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMalware_SeverityId'
          nullable: true
          description: The normalized identifier of the malware severity.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the specific malware instance, as assigned
            by the detection engine (e.g., virus signature ID or IPS rule ID).
      required:
        - classification_ids
    ocsfv1.6.0filehostingactivityMalware_ClassificationIds:
      title: ocsfv1.6.0filehostingactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityMalware_SeverityId:
      title: ocsfv1.6.0filehostingactivityMalware_SeverityId
      type: integer
      description: >-
        MalwareSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityMalwareScanInfo:
      title: ocsfv1.6.0filehostingactivityMalwareScanInfo
      type: object
      description: >-
        The malware scan information object describes characteristics, metadata
        of a malware scanning job.
      properties:
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        name:
          type: string
          nullable: true
          description: >-
            The administrator-supplied or application-generated name of the
            scan. For example: "Home office weekly user database scan", "Scan
            folders for viruses", "Full system virus scan"
        num_files:
          type: integer
          nullable: true
          description: The total number of files analyzed during the scan.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The total number of files identified as infected with malware during
            the scan.
        num_volumes:
          type: integer
          nullable: true
          description: >-
            The total number of storage volumes examined during the malware
            scan.
        size:
          type: integer
          nullable: true
          description: The total size in bytes of all files that were scanned.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        targets:
          type: array
          items:
            type: string
          nullable: true
          description: Hosts or IP addresses targeted by the scan.
        type:
          type: string
          nullable: true
          description: The type of scan.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityMalwareScanInfo_TypeId
          description: The type id of the scan.
        uid:
          type: string
          nullable: true
          description: >-
            The application-defined unique identifier assigned to an instance of
            a scan.
        unique_malware_count:
          type: integer
          nullable: true
          description: The number of unique malware detected across all infected files.
      required:
        - type_id
    ocsfv1.6.0filehostingactivityMalwareScanInfo_TypeId:
      title: ocsfv1.6.0filehostingactivityMalwareScanInfo_TypeId
      type: integer
      description: >-
        MalwareScanInfoTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Manual: The scan was manually initiated by the user or
        administrator.

        2 - Scheduled: The scan was started based on scheduler.

        3 - UpdatedContent: The scan was triggered by a content update.

        4 - QuarantinedItems: The scan was triggered by newly quarantined items.

        5 - AttachedMedia: The scan was triggered by the attachment of removable
        media.

        6 - UserLogon: The scan was started due to a user logon.

        7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM)
        detection.

        99 - Other: The scan type id is not mapped. See the <code>type</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityMetadata:
      title: ocsfv1.6.0filehostingactivityMetadata
      type: object
      description: The Metadata object describes the metadata associated with the event.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        debug:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Debug information about non-fatal issues with this OCSF event. Each
            issue is a line in this string array.
        event_code:
          type: string
          nullable: true
          description: >-
            The <code>Event ID, Code, or Name</code> that the product uses to
            primarily identify the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the OCSF event data has been truncated due to size
            limitations. When <code>true</code>, some event data may have been
            omitted to fit within system constraints.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of labels attached to the event. For example:
            <code>["sample", "dev"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            event.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        transformation_info_list:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0filehostingactivityTransformationInfo
          nullable: true
          description: >-
            An array of transformation info that describes the mappings or
            transforms applied to the data.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The original size of the OCSF event data in kilobytes before any
            truncation occurred. This field is typically populated when
            <code>is_truncated</code> is <code>true</code> to indicate the full
            size of the original event.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example:
            <code>1.0.0.</code> Event consumers use the version to determine the
            available event attributes.
      required:
        - product
        - version
    ocsfv1.6.0filehostingactivityMetric:
      title: ocsfv1.6.0filehostingactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.6.0filehostingactivityMitigation:
      title: ocsfv1.6.0filehostingactivityMitigation
      type: object
      description: >-
        The MITRE Mitigation object describes the ATT&amp;CK® or ATLAS™
        Mitigation ID and/or name that is associated to an attack.
      properties:
        countermeasures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityD3fend'
          nullable: true
          description: >-
            The D3FEND countermeasures that are associated with the attack
            technique. For example: ATT&amp;CK Technique <code>T1003</code> is
            addressed by Mitigation <code>M1027</code>, and D3FEND Technique
            <code>D3-OTP</code>.
        name:
          type: string
          nullable: true
          description: >-
            The Mitigation name that is associated with the attack technique.
            For example: <code>Password Policies</code>, or <code>Code
            Signing</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the Mitigation. For example:
            <code>https://attack.mitre.org/versions/v14/mitigations/M1027</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Mitigation ID that is associated with the attack technique. For
            example: <code>M1027</code>, or <code>AML.M0013</code>.
    ocsfv1.6.0filehostingactivityNetworkConnectionInfo:
      title: ocsfv1.6.0filehostingactivityNetworkConnectionInfo
      type: object
      description: >-
        The Network Connection Information object describes characteristics of
        an OSI Transport Layer communication, including TCP and UDP.
      properties:
        boundary:
          type: string
          nullable: true
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'. In the case of 'Other', it is defined by the event
            source. <p> For cloud connections, this translates to the
            traffic-boundary(same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        boundary_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkConnectionInfo_BoundaryId
          nullable: true
          description: >-
            <p>The normalized identifier of the boundary of the connection.
            </p><p> For cloud connections, this translates to the
            traffic-boundary (same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        community_uid:
          type: string
          nullable: true
          description: The Community ID of the network connection.
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the initiated connection, traffic, or email,
            normalized to the caption of the direction_id value. In the case of
            'Other', it is defined by the event source.
        direction_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkConnectionInfo_DirectionId
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email.
        flag_history:
          type: string
          nullable: true
          description: >-
            The Connection Flag History summarizes events in a network
            connection. For example flags <code> ShAD </code> representing SYN,
            SYN/ACK, ACK and Data exchange.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). For example: <code>tcp</code> or
            <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The IP protocol number, as defined by the Internet Assigned Numbers
            Authority (IANA). For example: <code>6</code> for TCP and
            <code>17</code> for UDP.
        protocol_ver:
          type: string
          nullable: true
          description: The Internet Protocol version.
        protocol_ver_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkConnectionInfo_ProtocolVerId
          nullable: true
          description: The Internet Protocol version identifier.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySession'
          nullable: true
          description: The authenticated user or service session.
        tcp_flags:
          type: integer
          nullable: true
          description: The network connection TCP header flags (i.e., control bits).
        uid:
          type: string
          nullable: true
          description: The unique identifier of the connection.
      required:
        - direction_id
    ocsfv1.6.0filehostingactivityNetworkConnectionInfo_BoundaryId:
      title: ocsfv1.6.0filehostingactivityNetworkConnectionInfo_BoundaryId
      type: integer
      description: >-
        NetworkConnectionInfoBoundaryId is an enum, and the following values are
        allowed.

        0 - Unknown: The connection boundary is unknown.

        1 - Localhost: Local network traffic on the same endpoint.

        2 - Internal: Internal network traffic between two endpoints inside
        network.

        3 - External: External network traffic between two endpoints on the
        Internet or outside the network.

        4 - SameVPC: Through another resource in the same VPC

        5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint

        6 - VirtualPrivateGateway: Through a virtual private gateway

        7 - regionVPC: Through an intra-region VPC peering connection

        8 - regionVPC: Through an inter-region VPC peering connection

        9 - LocalGateway: Through a local gateway

        10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances
        only)

        11 - InternetGateway: Through an Internet gateway (Nitro-based instances
        only)

        99 - Other: The boundary is not mapped. See the <code>boundary</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityNetworkConnectionInfo_DirectionId:
      title: ocsfv1.6.0filehostingactivityNetworkConnectionInfo_DirectionId
      type: integer
      description: >-
        NetworkConnectionInfoDirectionId is an enum, and the following values
        are allowed.

        0 - Unknown: The connection direction is unknown.

        1 - Inbound: Inbound network connection. The connection was originated
        from the Internet or outside network, destined for services on the
        inside network.

        2 - Outbound: Outbound network connection. The connection was originated
        from inside the network, destined for services on the Internet or
        outside network.

        3 - Lateral: Lateral network connection. The connection was originated
        from inside the network, destined for services on the inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0filehostingactivityNetworkConnectionInfo_ProtocolVerId:
      title: ocsfv1.6.0filehostingactivityNetworkConnectionInfo_ProtocolVerId
      type: integer
      description: >-
        NetworkConnectionInfoProtocolVerId is an enum, and the following values
        are allowed.

        0 - Unknown: The protocol version is unknown.

        4 - IPv4*

        6 - IPv6*

        99 - Other: The protocol version is not mapped. See the
        <code>protocol_ver</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityNetworkEndpoint:
      title: ocsfv1.6.0filehostingactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: >-
            The name of the domain that the endpoint belongs to or that
            corresponds to the endpoint.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkEndpoint_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.6.0filehostingactivityNetworkEndpoint_TypeId:
      title: ocsfv1.6.0filehostingactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityNetworkInterface:
      title: ocsfv1.6.0filehostingactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a physical or virtual network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        open_ports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPortInfo'
          nullable: true
          description: >-
            The list of open ports on a network interface, including port
            numbers and associated protocol information.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkInterface_TypeId
          nullable: true
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
    ocsfv1.6.0filehostingactivityNetworkInterface_TypeId:
      title: ocsfv1.6.0filehostingactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityNetworkProxy:
      title: ocsfv1.6.0filehostingactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: >-
            The name of the domain that the endpoint belongs to or that
            corresponds to the endpoint.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityNetworkProxy_TypeId
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.6.0filehostingactivityNetworkProxy_TypeId:
      title: ocsfv1.6.0filehostingactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityObject:
      title: ocsfv1.6.0filehostingactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.6.0filehostingactivityObservable:
      title: ocsfv1.6.0filehostingactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the OCSF event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - type_id
    ocsfv1.6.0filehostingactivityObservable_TypeId:
      title: ocsfv1.6.0filehostingactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. It may be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example:<br /><code>john_doe</code>.

        5 - EmailAddress: Email address. For example:<br
        /><code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example:<br /><code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example:<br />
        MD5: <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example:<br /><code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example:<br
        /><code>80</code>,<br /><code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction, and can include embedded URLs and
        files.

        23 - UniformResourceLocator: The Uniform Resource Locator (URL) object
        describes the characteristics of a URL.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details.

        25 - Process: The Process object describes a running instance of a
        launched program.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        45 - FilePath: The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.6.0filehostingactivityOrganization:
      title: ocsfv1.6.0filehostingactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any. Additionally, it also describes cloud
        and Software-as-a-Service (SaaS) logical hierarchies such as AWS
        Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and
        similar constructs.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the organization, Oracle Cloud Tenancy, Google Cloud
            Organization, or AWS Organization. For example, <code> Widget, Inc.
            </code> or the <code> AWS Organization name </code>.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of an organizational unit, Google Cloud Folder, or AWS Org
            Unit. For example, the <code> GCP Project Name </code>, or <code>
            Dev_Prod_OU </code>.
        ou_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of an organizational unit, Google Cloud
            Folder, or AWS Org Unit. For example, an <code> Oracle Cloud Tenancy
            ID </code>, <code> AWS OU ID </code>, or <code> GCP Folder ID
            </code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization, Oracle Cloud Tenancy,
            Google Cloud Organization, or AWS Organization. For example, an
            <code> AWS Org ID </code> or <code> Oracle Cloud Domain ID </code>.
    ocsfv1.6.0filehostingactivityOs:
      title: ocsfv1.6.0filehostingactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code).<p><b>Note:</b> The two letter country code
            should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        kernel_release:
          type: string
          nullable: true
          description: >-
            The kernel release of the operating system. On Unix-based systems,
            this is determined from the <code>uname -r</code> command output,
            for example "5.15.0-122-generic".
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.6.0filehostingactivityOs_TypeId:
      title: ocsfv1.6.0filehostingactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.6.0filehostingactivityOsint:
      title: ocsfv1.6.0filehostingactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        campaign:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCampaign'
          nullable: true
          description: >-
            The campaign object describes details about the campaign that was
            the source of the activity.
        category:
          type: string
          nullable: true
          description: >-
            Categorizes the threat indicator based on its functional or
            operational role.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        creator:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: >-
            The identifier of the user, system, or organization that contributed
            the indicator.
        desc:
          type: string
          nullable: true
          description: >-
            A detailed explanation of the indicator, including its context,
            purpose, and relevance.
        detection_pattern:
          type: string
          nullable: true
          description: >-
            The specific detection pattern or signature associated with the
            indicator.
        detection_pattern_type:
          type: string
          nullable: true
          description: >-
            The detection pattern type, normalized to the caption of the
            detection_pattern_type_id value. In the case of 'Other', it is
            defined by the event source.
        detection_pattern_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityOsint_DetectionPatternTypeId
          nullable: true
          description: >-
            Specifies the type of detection pattern used to identify the
            associated threat indicator.
        email:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        external_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier assigned by an external system for
            cross-referencing.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          nullable: true
          description: >-
            Any pertinent file information related to an indicator or OSINT
            analysis.
        intrusion_sets:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A grouping of adversarial behaviors and resources believed to be
            associated with specific threat actors or campaigns. Intrusion sets
            often encompass multiple campaigns and are used to organize related
            activities under a common label.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Tags or keywords associated with the indicator to enhance
            searchability.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        name:
          type: string
          nullable: true
          description: >-
            The <code>name</code> is a pointer/reference to an attribute within
            the OCSF event data. For example: file.name.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Provides a reference to an external source of information related to
            the CTI being represented. This may include a URL, a document, or
            some other type of reference that provides additional context or
            information about the CTI.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAnalytic'
          nullable: true
          description: Any analytics related to an indicator or OSINT analysis.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityReputation'
          nullable: true
          description: >-
            Related reputational analysis from third-party engines and analysts
            for a given indicator or OSINT analysis.
        risk_score:
          type: integer
          nullable: true
          description: A numerical representation of the threat indicator’s risk level.
        script:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityScript'
          nullable: true
          description: >-
            Any pertinent script information related to an indicator or OSINT
            analysis.
        severity:
          type: string
          nullable: true
          description: >-
            Represents the severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOsint_SeverityId'
          nullable: true
          description: >-
            The normalized severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySubnet'
          nullable: true
          description: A CIDR or network block related to an indicator or OSINT analysis.
        threat_actor:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityThreatActor'
          nullable: true
          description: >-
            A threat actor is an individual or group that conducts malicious
            cyber activities, often with financial, political, or ideological
            motives.
        tlp:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the OSINT object.
        uploaded_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        uploaded_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.6.0filehostingactivityOsint_ConfidenceId:
      title: ocsfv1.6.0filehostingactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityOsint_DetectionPatternTypeId:
      title: ocsfv1.6.0filehostingactivityOsint_DetectionPatternTypeId
      type: integer
      description: >-
        OsintDetectionPatternTypeId is an enum, and the following values are
        allowed.

        0 - Unknown: The type is not mapped.

        1 - STIX

        2 - PCRE

        3 - SIGMA

        4 - Snort

        5 - Suricata

        6 - YARA

        99 - Other: The detection pattern type is not mapped. See the
        <code>detection_pattern_type</code> attribute, which contains a data
        source specific value.
    ocsfv1.6.0filehostingactivityOsint_SeverityId:
      title: ocsfv1.6.0filehostingactivityOsint_SeverityId
      type: integer
      description: >-
        OsintSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityOsint_Tlp:
      title: ocsfv1.6.0filehostingactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.

        WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably,
        TLP:WHITE is the most up to date (as of TLP 2.0) usage.
    ocsfv1.6.0filehostingactivityOsint_TypeId:
      title: ocsfv1.6.0filehostingactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP,
        VHASH, etc. generated from a file, malware sample, request header, or
        otherwise used to identify a pertinent artifact.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        11 - File: A file or metadata about a file.

        12 - RegistryKey: A Windows Registry Key.

        13 - RegistryValue: A Windows Registry Value.

        14 - CommandLine: A partial or full Command Line used to invoke scripts
        or other remote commands.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.6.0filehostingactivityPackage:
      title: ocsfv1.6.0filehostingactivityPackage
      type: object
      description: The Software Package object describes details about a software package.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.6.0filehostingactivityPackage_TypeId:
      title: ocsfv1.6.0filehostingactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityPolicy:
      title: ocsfv1.6.0filehostingactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        data:
          nullable: true
          description: >-
            Additional data about the policy such as the underlying JSON policy
            itself or other details.
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: >-
            The policy name. For example: <code>AdministratorAccess
            Policy</code>.
        type:
          type: string
          nullable: true
          description: >-
            The policy type. For example: <code>Identity Policy, Resource
            Policy, Service Control Policy, etc./code&gt;.</code>
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.6.0filehostingactivityPortInfo:
      title: ocsfv1.6.0filehostingactivityPortInfo
      type: object
      description: >-
        The Port Information object describes a port and its associated protocol
        details.
      properties:
        port:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPort'
          description: >-
            The port number. For example: <code>80</code>, <code>443</code>,
            <code>22</code>.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). For example: <code>tcp</code> or
            <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The IP protocol number, as defined by the Internet Assigned Numbers
            Authority (IANA). For example: <code>6</code> for TCP and
            <code>17</code> for UDP.
      required:
        - port
    ocsfv1.6.0filehostingactivityProcess:
      title: ocsfv1.6.0filehostingactivityProcess
      type: object
      description: The Process object describes a running instance of a launched program.
      properties:
        ancestry:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProcessEntity'
          nullable: true
          description: >-
            An array of Process Entities describing the extended parentage of
            this process object. Direct parent information should be expressed
            through the <code>parent_process</code> attribute. The first array
            element is the direct parent of this process object. Subsequent list
            elements go up the process parentage hierarchy. That is, the array
            is sorted from newest to oldest process. It is recommended to only
            populate this field for the top-level process object.
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        environment_variables:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0filehostingactivityEnvironmentVariable
          nullable: true
          description: Environment variables associated with the process.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityProcess_IntegrityId
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFilePath'
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the top-level process object, to prevent
            deep nesting. Additional ancestry information can be supplied in the
            <code>ancestry</code> attribute.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        ptid:
          type: integer
          nullable: true
          description: >-
            The identifier of the process thread associated with the event, as
            returned by the operating system.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser'
          nullable: true
          description: The user under which this process is running.
        working_directory:
          type: string
          nullable: true
          description: The working directory of a process.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.6.0filehostingactivityProcess_IntegrityId:
      title: ocsfv1.6.0filehostingactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityProcessEntity:
      title: ocsfv1.6.0filehostingactivityProcessEntity
      type: object
      description: >-
        The Process Entity object provides critical fields for referencing a
        process.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
    ocsfv1.6.0filehostingactivityProduct:
      title: ocsfv1.6.0filehostingactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.6.0filehostingactivityProgrammaticCredential:
      title: ocsfv1.6.0filehostingactivityProgrammaticCredential
      type: object
      description: >-
        The Programmatic Credential object describes service-specific
        credentials used for direct API access and system integration. These
        credentials are typically issued by individual services or platforms for
        accessing their APIs and resources, focusing on credential lifecycle
        management and usage tracking. Examples include API keys, service
        account keys, client certificates, and vendor-specific access tokens.
      properties:
        last_used_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when this programmatic credential was last used for
            authentication or API access. This helps track credential usage
            patterns, identify dormant credentials that may pose security risks,
            and support credential lifecycle management. The timestamp should
            reflect the most recent successful authentication or API call using
            this credential.
        last_used_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when this programmatic credential was last used for
            authentication or API access. This helps track credential usage
            patterns, identify dormant credentials that may pose security risks,
            and support credential lifecycle management. The timestamp should
            reflect the most recent successful authentication or API call using
            this credential.
        type:
          type: string
          nullable: true
          description: >-
            The type or category of programmatic credential, normalized to the
            caption of the type_id value. In the case of 'Other', it is defined
            by the event source. Examples include 'API Key', 'Service Account
            Key', 'Access Token', 'Client Certificate', 'OAuth Token', 'Personal
            Access Token', etc.
        uid:
          type: string
          description: >-
            The unique identifier of the programmatic credential. This could be
            an API key ID, service account key ID, access token identifier,
            certificate serial number, or other unique identifier that
            distinguishes this credential from others. Examples: AWS Access Key
            ID, GCP Service Account Key ID, Azure Application ID, or OAuth2
            token identifier.
      required:
        - uid
    ocsfv1.6.0filehostingactivityRemediation:
      title: ocsfv1.6.0filehostingactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        cis_controls:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCisControl'
          nullable: true
          description: >-
            An array of Center for Internet Security (CIS) Controls that can be
            optionally mapped to provide additional remediation details.
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.6.0filehostingactivityReputation:
      title: ocsfv1.6.0filehostingactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.6.0filehostingactivityReputation_ScoreId:
      title: ocsfv1.6.0filehostingactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityRequest:
      title: ocsfv1.6.0filehostingactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api request.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.6.0filehostingactivityResponse:
      title: ocsfv1.6.0filehostingactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api response.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.6.0filehostingactivityRule:
      title: ocsfv1.6.0filehostingactivityRule
      type: object
      description: >-
        The Rule object describes characteristics of a rule associated with a
        policy or an event.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.6.0filehostingactivitySan:
      title: ocsfv1.6.0filehostingactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.6.0filehostingactivityScim:
      title: ocsfv1.6.0filehostingactivityScim
      type: object
      description: >-
        The System for Cross-domain Identity Management (SCIM) Configuration
        object provides a structured set of attributes related to SCIM protocols
        used for identity provisioning and management across cloud-based
        platforms. It standardizes user and group provisioning details, enabling
        identity synchronization and lifecycle management with compatible
        Identity Providers (IdPs) and applications. SCIM is defined in <a
        target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityScim_AuthProtocolId
          nullable: true
          description: >-
            The normalized identifier of the authorization protocol used by the
            SCIM resource.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: When the SCIM resource was added to the service provider.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SCIM resource was added to the service provider.
        error_message:
          type: string
          nullable: true
          description: Message or code associated with the last encountered error.
        is_group_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            groups, automatically or otherwise.
        is_user_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            users, automatically or otherwise.
        last_run_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        name:
          type: string
          nullable: true
          description: The name of the SCIM resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SCIM resource. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        rate_limit:
          type: integer
          nullable: true
          description: >-
            Maximum number of requests allowed by the SCIM resource within a
            specified time frame to avoid throttling.
        scim_group_schema:
          nullable: true
          description: >-
            SCIM provides a schema for representing groups, identified using the
            following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:Group</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            This attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource.
        scim_user_schema:
          nullable: true
          description: >-
            SCIM provides a resource type for user resources. The core schema
            for user is identified using the following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:User</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            his attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource. This object is inclusive of both the
            basic and Enterprise User Schema Extension.
        state:
          type: string
          nullable: true
          description: >-
            The provisioning state of the SCIM resource, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityScim_StateId'
          nullable: true
          description: >-
            The normalized state ID of the SCIM resource to reflect its
            activation status.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for a SCIM resource as defined by the service
            provider.
        uid_alt:
          type: string
          nullable: true
          description: >-
            A String that is an identifier for the resource as defined by the
            provisioning client. The <code>externalId</code> may simplify
            identification of a resource between the provisioning client and the
            service provider by allowing the client to use a filter to locate
            the resource with an identifier from the provisioning domain,
            obviating the need to store a local mapping between the provisioning
            domain's identifier of the resource and the identifier used by the
            service provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: The primary URL for SCIM API requests.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SCIM. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
        version:
          type: string
          nullable: true
          description: SCIM protocol version supported e.g., <code>SCIM 2.0</code>.
    ocsfv1.6.0filehostingactivityScim_AuthProtocolId:
      title: ocsfv1.6.0filehostingactivityScim_AuthProtocolId
      type: integer
      description: >-
        ScimAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityScim_StateId:
      title: ocsfv1.6.0filehostingactivityScim_StateId
      type: integer
      description: >-
        ScimStateId is an enum, and the following values are allowed.

        0 - Unknown: The provisioning state of the SCIM resource is unknown.

        1 - Pending: The SCIM resource is Pending activation or creation.

        2 - Active: The SCIM resource is in an Active state, or otherwise
        enabled.

        3 - Failed: The SCIM resource is in a Failed state.

        4 - Deleted: The SCIM resource is in a Deleted state, or otherwise
        disabled.

        99 - Other: The provisioning state of the SCIM resource is not mapped.
        See the <code>state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityScript:
      title: ocsfv1.6.0filehostingactivityScript
      type: object
      description: >-
        The Script object describes a script or command that can be executed by
        a shell, script engine, or interpreter. Examples include Bash,
        JavsScript, PowerShell, Python, VBScript, etc. Note that the term
        <em>script</em> here denotes not only a script contained within a file
        but also a script or command typed interactively by a user, supplied on
        the command line, or provided by some other file-less mechanism.
      properties:
        file:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFile'
          nullable: true
          description: >-
            Present if this script is associated with a file. Not present in the
            case of a file-less script.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityFingerprint'
          nullable: true
          description: >-
            An array of the script's cryptographic hashes. Note that these
            hashes are calculated on the script in its original encoding, and
            not on the normalized UTF-8 encoding found in the
            <code>script_content</code> attribute.
        name:
          type: string
          nullable: true
          description: >-
            Unique identifier for the script or macro, independent of the
            containing file, used for tracking, auditing, and security analysis.
        parent_uid:
          type: string
          nullable: true
          description: >-
            This attribute relates a sub-script to a parent script having the
            matching <code>uid</code> attribute. In the case of PowerShell,
            sub-script execution can be identified by matching the activity
            correlation ID of the raw ETW events provided by the OS.
        script_content:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLongString'
          description: >-
            The script content, normalized to UTF-8 encoding irrespective of its
            original encoding. When emitting this attribute, it may be
            appropriate to truncate large scripts. When consuming this
            attribute, large scripts should be anticipated.
        type:
          type: string
          nullable: true
          description: >-
            The script type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityScript_TypeId'
          description: The normalized script type ID.
        uid:
          type: string
          nullable: true
          description: >-
            Some script engines assign a unique ID to each individual execution
            of a given script. This attribute captures that unique ID. In the
            case of PowerShell, the unique ID corresponds to the
            <code>ScriptBlockId</code> in the raw ETW events provided by the OS.
      required:
        - script_content
        - type_id
    ocsfv1.6.0filehostingactivityScript_TypeId:
      title: ocsfv1.6.0filehostingactivityScript_TypeId
      type: integer
      description: >-
        ScriptTypeId is an enum, and the following values are allowed.

        0 - Unknown: The script type is unknown.

        1 - WindowsCommandPrompt

        2 - PowerShell

        3 - Python

        4 - JavaScript

        5 - VBScript

        6 - UnixShell

        7 - VBA

        99 - Other: The script type is not mapped. See the <code>type</code>
        attribute which contains an event source specific value.
    ocsfv1.6.0filehostingactivityService:
      title: ocsfv1.6.0filehostingactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.6.0filehostingactivitySession:
      title: ocsfv1.6.0filehostingactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.6.0filehostingactivitySharing:
      title: ocsfv1.6.0filehostingactivitySharing
      type: object
      description: >-
        The Sharing object encompasses information about how and with whom a
        resource was shared.
      properties:
        actors:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityActor'
          nullable: true
          description: >-
            The actor(s) with whom the resource has been shared. Note that with
            the addition of groups to the Actor object, sharing with a group can
            be represented by an Actor object with an empty user field and a
            populated groups field.
        anonymous:
          type: boolean
          nullable: true
          description: True if anonymous access is enabled for sharing.
        can_reshare:
          type: boolean
          nullable: true
          description: True if the recipients have permission to re-share the resource.
        link_id:
          type: string
          nullable: true
          description: Unique ID of a sharing link.
        permissions:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0filehostingactivitySharingPermission
          nullable: true
          description: List of permissions granted.
        scope:
          type: string
          nullable: true
          description: The scope, normalized to the caption of the scope_id value.
        scope_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySharing_ScopeId'
          nullable: true
          description: The normalized identifier of the sharing scope.
        sharing_action:
          type: string
          nullable: true
          description: >-
            Describes the nature of a sharing action, such as creating a link
            for others to access a resource.
    ocsfv1.6.0filehostingactivitySharing_ScopeId:
      title: ocsfv1.6.0filehostingactivitySharing_ScopeId
      type: integer
      description: |-
        SharingScopeId is an enum, and the following values are allowed.
        0 - Unknown: The scope is unknown.
        1 - User: User scope.
        2 - Group: Group scope.
        3 - Tenant: Tenant scope.
        4 - Organization: Organization scope.
        5 - World: World scope.
        99 - Other: The scope is not mapped.
    ocsfv1.6.0filehostingactivitySharingPermission:
      title: ocsfv1.6.0filehostingactivitySharingPermission
      type: object
      description: >-
        The Sharing Permission type represents the permissions granted to
        recipients via a Sharing object.
      properties:
        sharing_permission_type:
          type: string
          nullable: true
          description: >-
            The sharing permission type, normalized to the caption of the
            sharing_permission_type_id value.
        sharing_permission_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivitySharingPermission_SharingPermissionTypeId
          description: The normalized identifier of the sharing permission type.
      required:
        - sharing_permission_type_id
    ocsfv1.6.0filehostingactivitySharingPermission_SharingPermissionTypeId:
      title: ocsfv1.6.0filehostingactivitySharingPermission_SharingPermissionTypeId
      type: integer
      description: >-
        SharingPermissionSharingPermissionTypeId is an enum, and the following
        values are allowed.

        0 - Unknown: The sharing permission type is unknown.

        1 - View: View permission.

        2 - Modify: Modify permission.

        99 - Other: The sharing permission type is not mapped.
    ocsfv1.6.0filehostingactivitySso:
      title: ocsfv1.6.0filehostingactivitySso
      type: object
      description: >-
        The Single Sign-On (SSO) object provides a structure for normalizing SSO
        attributes, configuration, and/or settings from Identity Providers.
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySso_AuthProtocolId'
          nullable: true
          description: >-
            The normalized identifier of the authentication protocol used by the
            SSO resource.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCertificate'
          nullable: true
          description: >-
            Digital Signature associated with the SSO resource, e.g., SAML X.509
            certificate details.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: When the SSO resource was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SSO resource was created.
        duration_mins:
          type: integer
          nullable: true
          description: >-
            The duration (in minutes) for an SSO session, after which
            re-authentication is required.
        idle_timeout:
          type: integer
          nullable: true
          description: >-
            Duration (in minutes) of allowed inactivity before Single Sign-On
            (SSO) session expiration.
        login_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: URL for initiating an SSO login request.
        logout_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            URL for initiating an SSO logout request, allowing sessions to be
            terminated across applications.
        metadata_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            URL where metadata about the SSO configuration is available (e.g.,
            for SAML configurations).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The most recent time when the SSO resource was updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent time when the SSO resource was updated.
        name:
          type: string
          nullable: true
          description: The name of the SSO resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SSO resource. E.g., <code>SAML</code>
            or <code>OIDC</code>.
        scopes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Scopes define the specific permissions or actions that the client is
            allowed to perform on behalf of the user. Each scope represents a
            different set of permissions, and the user can selectively grant or
            deny access to specific scopes during the authorization process.
        uid:
          type: string
          nullable: true
          description: A unique identifier for a SSO resource.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SSO. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
    ocsfv1.6.0filehostingactivitySso_AuthProtocolId:
      title: ocsfv1.6.0filehostingactivitySso_AuthProtocolId
      type: integer
      description: >-
        SsoAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivitySubTechnique:
      title: ocsfv1.6.0filehostingactivitySubTechnique
      type: object
      description: >-
        The MITRE Sub-technique object describes the ATT&amp;CK® or ATLAS™
        Sub-technique ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub-technique. For example: <code>Scanning IP
            Blocks</code> or <code>User Execution: Unsafe ML Artifacts</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub-technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub-technique. For example:
            <code>T1595.001</code> or <code>AML.T0011.000</code>.
    ocsfv1.6.0filehostingactivityTactic:
      title: ocsfv1.6.0filehostingactivityTactic
      type: object
      description: >-
        The MITRE Tactic object describes the ATT&amp;CK® or ATLAS™ Tactic ID
        and/or name that is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The Tactic name that is associated with the attack technique. For
            example: <code>Reconnaissance</code> or <code>ML Model
            Access</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the Tactic. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Tactic ID that is associated with the attack technique. For
            example: <code>TA0043</code>, or <code>AML.TA0000</code>.
    ocsfv1.6.0filehostingactivityTechnique:
      title: ocsfv1.6.0filehostingactivityTechnique
      type: object
      description: >-
        The MITRE Technique object describes the ATT&amp;CK® or ATLAS™ Technique
        ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique. For example: <code>Active
            Scanning</code> or <code>AI Model Inference API Access</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique. For example:
            <code>T1595</code> or <code>AML.T0040</code>.
    ocsfv1.6.0filehostingactivityThreatActor:
      title: ocsfv1.6.0filehostingactivityThreatActor
      type: object
      description: Threat actor is responsible for the observed malicious activity.
      properties:
        name:
          type: string
          description: The name of the threat actor.
        type:
          type: string
          nullable: true
          description: >-
            The classification of the threat actor based on their motivations,
            capabilities, or affiliations. Common types include nation-state
            actors, cybercriminal groups, hacktivists, or insider threats.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityThreatActor_TypeId'
          nullable: true
          description: The normalized datastore resource type identifier.
      required:
        - name
    ocsfv1.6.0filehostingactivityThreatActor_TypeId:
      title: ocsfv1.6.0filehostingactivityThreatActor_TypeId
      type: integer
      description: |-
        ThreatActorTypeId is an enum, and the following values are allowed.
        0 - Unknown: The threat actor type is unknown.
        1 - state
        2 - Cybercriminal
        3 - Hacktivists
        4 - Insider
        99 - Other: The threat actor type is not mapped.
    ocsfv1.6.0filehostingactivityTimespan:
      title: ocsfv1.6.0filehostingactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may be populated since each member is of integral type. In
        that case <code>type_id</code> if present should be set to
        <code>Other.</code><p>A timespan may also be defined by its time
        interval boundaries, <code>start_time</code> and
        <code>end_time</code>.</p>
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The start time or beginning of the timespan's interval.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The start time or beginning of the timespan's interval.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.6.0filehostingactivityTimespan_TypeId:
      title: ocsfv1.6.0filehostingactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        9 - TimeInterval: The <code>start_time</code> and <code>end_time</code>
        should be set.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityTransformationInfo:
      title: ocsfv1.6.0filehostingactivityTransformationInfo
      type: object
      description: >-
        The transformation_info object represents the mapping or transformation
        used.
      properties:
        lang:
          type: string
          nullable: true
          description: The transformation language used to transform the data.
        name:
          type: string
          nullable: true
          description: The name of the transformation or mapping.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityProduct'
          nullable: true
          description: The product or instance used to make the transformation
        time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: Time of the transformation.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: Time of the transformation.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the mapping or transformation.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The Uniform Resource Locator String where the mapping or
            transformation exists.
    ocsfv1.6.0filehostingactivityUrl:
      title: ocsfv1.6.0filehostingactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator (URL) object describes the characteristics
        of a URL.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.6.0filehostingactivityUrl_CategoryIds:
      title: ocsfv1.6.0filehostingactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.6.0filehostingactivityUser:
      title: ocsfv1.6.0filehostingactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        display_name:
          type: string
          nullable: true
          description: The display name of the user, as reported by the product.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        forward_addr:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The user's forwarding email address.
        full_name:
          type: string
          nullable: true
          description: The full name of the user, as reported by the product.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        phone_number:
          type: string
          nullable: true
          description: The telephone number of the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        programmatic_credentials:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0filehostingactivityProgrammaticCredential
          nullable: true
          description: >-
            Details about the programmatic credential (API keys, access tokens,
            certificates, etc) associated to the user.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.6.0filehostingactivityUser_MfaStatusId:
      title: ocsfv1.6.0filehostingactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityUser_RiskLevelId:
      title: ocsfv1.6.0filehostingactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0filehostingactivityUser_TypeId:
      title: ocsfv1.6.0filehostingactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        4 - Service: Service account. For example, Windows service account.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0filehostingactivityUser_UserStatusId:
      title: ocsfv1.6.0filehostingactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityVulnerability:
      title: ocsfv1.6.0filehostingactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        advisory:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAdvisory'
          nullable: true
          description: >-
            Detail about the security advisory, that is used to publicly
            disclose cybersecurity vulnerabilities by a vendor.
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        category:
          type: string
          nullable: true
          description: >-
            The category of a vulnerability or weakness, as reported by the
            source tool, such as <code>Container Security</code> or <code>Open
            Source Security</code>.
        cve:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCve'
          nullable: true
          description: >-
            Describes the Common Vulnerabilities and Exposures <a
            target='_blank' href='https://cve.mitre.org/'>(CVE)</a> details
            related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target='_blank'
            href='https://cwe.mitre.org/'>(CWE)</a> details related to the
            vulnerability.
        dependency_chain:
          type: string
          nullable: true
          description: >-
            Information about the chain of dependencies related to the issue as
            reported by an Application Security or Vulnerability Management
            tool. E.g., <code>serverless-offline -&gt; @serverless/utils -&gt;
            memoizee -&gt; es5-ext</code>.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        exploit_last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_ref_url:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityURLString'
          nullable: true
          description: The URL of the exploit code or Proof-of-Concept (PoC).
        exploit_requirement:
          type: string
          nullable: true
          description: >-
            The requirement description related to any constraints around
            exploit execution.
        exploit_type:
          type: string
          nullable: true
          description: >-
            The categorization or type of Exploit. E.g., <code>Network</code> or
            <code>Physical</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        fix_coverage:
          type: string
          nullable: true
          description: >-
            The fix coverage, normalized to the caption of the
            <code>fix_coverage_id</code> value.
        fix_coverage_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityVulnerability_FixCoverageId
          nullable: true
          description: >-
            The normalized identifier for fix coverage, applicable to this
            vulnerability. Typically useful, when there are multiple affected
            packages but only a subset have available fixes.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            List of vulnerability IDs (e.g. CVE ID) that are related to this
            vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.6.0filehostingactivityVulnerability_FixCoverageId:
      title: ocsfv1.6.0filehostingactivityVulnerability_FixCoverageId
      type: integer
      description: >-
        VulnerabilityFixCoverageId is an enum, and the following values are
        allowed.

        0 - Unknown: The fix coverage is unknown.

        1 - Complete: All affected packages and components have available fixes
        or patches to remediate the vulnerability.

        2 - Partial: Only some of the affected packages and components have
        available fixes or patches, while others remain vulnerable.

        3 - None: No fixes or patches are currently available for any of the
        affected packages and components.

        99 - Other: The fix coverage is not mapped. See the
        <code>fix_coverage</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0filehostingactivityWhois:
      title: ocsfv1.6.0filehostingactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0filehostingactivityWhois_DnssecStatusId
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The domain name corresponding to the WHOIS record.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0filehostingactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.6.0filehostingactivityWhois_DnssecStatusId:
      title: ocsfv1.6.0filehostingactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityEmailAddress:
      title: ocsfv1.6.0httpactivityEmailAddress
      type: string
      description: Email address. For example:<br /><code>john_doe@example.com</code>.
    ocsfv1.6.0httpactivityFileName:
      title: ocsfv1.6.0httpactivityFileName
      type: string
      description: File name. For example:<br /><code>text-file.txt</code>.
    ocsfv1.6.0httpactivityFilePath:
      title: ocsfv1.6.0httpactivityFilePath
      type: string
      description: >-
        The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.
    ocsfv1.6.0httpactivityHash:
      title: ocsfv1.6.0httpactivityHash
      type: string
      description: >-
        Hash. A unique value that corresponds to the content of the file, image,
        ja3_hash or hassh found in the schema. For example:<br /> MD5:
        <code>3172ac7e2b55cbb81f04a6e65855a628</code>.
    ocsfv1.6.0httpactivityHostname:
      title: ocsfv1.6.0httpactivityHostname
      type: string
      description: >-
        Unique name assigned to a device connected to a computer network. It may
        be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>
    ocsfv1.6.0httpactivityIPAddress:
      title: ocsfv1.6.0httpactivityIPAddress
      type: string
      description: >-
        Internet Protocol address (IP address), in either IPv4 or IPv6 format.
        For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.
    ocsfv1.6.0httpactivityMACAddress:
      title: ocsfv1.6.0httpactivityMACAddress
      type: string
      description: >-
        Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.
    ocsfv1.6.0httpactivityPort:
      title: ocsfv1.6.0httpactivityPort
      type: integer
      description: >-
        The TCP/UDP port number. For example:<br /><code>80</code>,<br
        /><code>22</code>.
    ocsfv1.6.0httpactivityProcessName:
      title: ocsfv1.6.0httpactivityProcessName
      type: string
      description: Process name. For example:<br /><code>Notepad</code>.
    ocsfv1.6.0httpactivitySubnet:
      title: ocsfv1.6.0httpactivitySubnet
      type: string
      description: >-
        The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>
    ocsfv1.6.0httpactivityTimestamp:
      title: ocsfv1.6.0httpactivityTimestamp
      type: integer
      description: >-
        The timestamp format is the number of milliseconds since the Epoch
        01/01/1970 00:00:00 UTC. For example:<br /><code>1618524549901</code>.
    ocsfv1.6.0httpactivityURLString:
      title: ocsfv1.6.0httpactivityURLString
      type: string
      description: >-
        Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.
    ocsfv1.6.0httpactivityUserName:
      title: ocsfv1.6.0httpactivityUserName
      type: string
      description: User name. For example:<br /><code>john_doe</code>.
    ocsfv1.6.0httpactivityActionId:
      title: ocsfv1.6.0httpactivityActionId
      type: integer
      description: >-
        ActionId is an enum, and the following values are allowed.

        0 - Unknown: The action was unknown. The <code>disposition_id</code>
        attribute may still be set to a non-unknown value, for example 'Custom
        Action', 'Challenge'.

        1 - Allowed: The activity was allowed. The <code>disposition_id</code>
        attribute should be set to a value that conforms to this action, for
        example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc.

        2 - Denied: The attempted activity was denied. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Blocked', 'Rejected',
        'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc.

        3 - Observed: The activity was observed, but neither explicitly allowed
        nor denied. This is common with IDS and EDR controls that report
        additional information on observed behavior such as TTPs. The
        <code>disposition_id</code> attribute should be set to a value that
        conforms to this action, for example 'Logged', 'Alert', 'Detected',
        'Count', etc.

        4 - Modified: The activity was modified, adjusted, or corrected. The
        <code>disposition_id</code> attribute should be set appropriately, for
        example 'Restored', 'Corrected', 'Delayed', 'Captcha', 'Tagged'.

        99 - Other: The action is not mapped. See the <code>action</code>
        attribute which contains a data source specific value.
    ocsfv1.6.0httpactivityActivityId:
      title: ocsfv1.6.0httpactivityActivityId
      type: integer
      description: >-
        ActivityId is an enum, and the following values are allowed.

        0 - Unknown: The event activity is unknown.

        1 - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        2 - Delete: The DELETE method deletes the specified resource.

        3 - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        4 - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        5 - Options: The OPTIONS method describes the communication options for
        the target resource.

        6 - Post: The POST method submits an entity to the specified resource,
        often causing a change in state or side effects on the server.

        7 - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        8 - Trace: The TRACE method performs a message loop-back test along the
        path to the target resource.

        9 - Patch: The PATCH method applies partial modifications to a resource.

        99 - Other: The event activity is not mapped. See the
        <code>activity_name</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityCategoryUid:
      title: ocsfv1.6.0httpactivityCategoryUid
      type: integer
      description: |-
        CategoryUid is an enum, and the following values are allowed.
        4 - NetworkActivity: Network Activity events.
    ocsfv1.6.0httpactivityClassUid:
      title: ocsfv1.6.0httpactivityClassUid
      type: integer
      description: >-
        ClassUid is an enum, and the following values are allowed.

        4002 - HTTPActivity: HTTP Activity events report HTTP connection and
        traffic information.
    ocsfv1.6.0httpactivityConfidenceId:
      title: ocsfv1.6.0httpactivityConfidenceId
      type: integer
      description: >-
        ConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityDispositionId:
      title: ocsfv1.6.0httpactivityDispositionId
      type: integer
      description: >-
        DispositionId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Allowed: Granted access or allowed the action to the protected
        resource.

        2 - Blocked: Denied access or blocked the action to the protected
        resource.

        3 - Quarantined: A suspicious file or other content was moved to a
        benign location.

        4 - Isolated: A session was isolated on the network or within a browser.

        5 - Deleted: A file or other content was deleted.

        6 - Dropped: The request was detected as a threat and resulted in the
        connection being dropped.

        7 - CustomAction: A custom action was executed such as running of a
        command script. Use the <code>message</code> attribute of the base class
        for details.

        8 - Approved: A request or submission was approved. For example, when a
        form was properly filled out and submitted. This is distinct from
        <code>1</code> 'Allowed'.

        9 - Restored: A quarantined file or other content was restored to its
        original location.

        10 - Exonerated: A suspicious or risky entity was deemed to no longer be
        suspicious (re-scored).

        11 - Corrected: A corrupt file or configuration was corrected.

        12 - PartiallyCorrected: A corrupt file or configuration was partially
        corrected.

        13 - Uncorrected: A corrupt file or configuration was not corrected.

        14 - Delayed: An operation was delayed, for example if a restart was
        required to finish the operation.

        15 - Detected: Suspicious activity or a policy violation was detected
        without further action.

        16 - NoAction: The outcome of an operation had no action taken.

        17 - Logged: The operation or action was logged without further action.

        18 - Tagged: A file or other entity was marked with extended attributes.

        19 - Alert: The request or activity was detected as a threat and
        resulted in a notification but request was not blocked.

        20 - Count: Counted the request or activity but did not determine
        whether to allow it or block it.

        21 - Reset: The request was detected as a threat and resulted in the
        connection being reset.

        22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove
        that a human being is sending the request.

        23 - Challenge: Ran a silent challenge that required the client session
        to verify that it's a browser, and not a bot.

        24 - AccessRevoked: The requestor's access has been revoked due to
        security policy enforcements. Note: use the <code>Host</code> profile if
        the <code>User</code> or <code>Actor</code> requestor is not present in
        the event class.

        25 - Rejected: A request or submission was rejected. For example, when a
        form was improperly filled out and submitted. This is distinct from
        <code>2</code> 'Blocked'.

        26 - Unauthorized: An attempt to access a resource was denied due to an
        authorization check that failed. This is a more specific disposition
        than <code>2</code> 'Blocked' and can be complemented with the
        <code>authorizations</code> attribute for more detail.

        27 - Error: An error occurred during the processing of the activity or
        request. Use the <code>message</code> attribute of the base class for
        details.

        99 - Other: The disposition is not mapped. See the
        <code>disposition</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityHttpActivity:
      title: ocsfv1.6.0httpactivityHttpActivity
      type: object
      description: HTTP Activity events report HTTP connection and traffic information.
      properties:
        action:
          type: string
          nullable: true
          description: The normalized caption of <code>action_id</code>.
        action_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityActionId'
          nullable: true
          description: >-
            The action taken by a control or other policy-based system leading
            to an outcome or disposition. An unknown action may still correspond
            to a known disposition. Refer to <code>disposition_id</code> for the
            outcome of the action.
        activity_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityActivityId'
          description: The normalized identifier of the activity that triggered the event.
        activity_name:
          type: string
          nullable: true
          description: The event activity name, as defined by the activity_id.
        actor:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityActor'
          nullable: true
          description: >-
            The actor object describes details about the user/role/process that
            was the source of the activity. Note that this is not the threat
            actor of a campaign but may be part of a campaign.
        api:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityApi'
          nullable: true
          description: >-
            Describes details about a typical API (Application Programming
            Interface) call.
        app_name:
          type: string
          nullable: true
          description: The name of the application associated with the event or object.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAttack'
          nullable: true
          description: >-
            An array of MITRE ATT&amp;CK® objects describing identified tactics,
            techniques &amp; sub-techniques. The objects are compatible with
            MITRE ATLAS™ tactics, techniques &amp; sub-techniques.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        category_name:
          type: string
          nullable: true
          description: >-
            The event category name, as defined by category_uid value:
            <code>Network Activity</code>.
        category_uid:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCategoryUid'
          description: The category unique identifier of the event.
        class_uid:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityClassUid'
          description: >-
            The unique identifier of a class. A class describes the attributes
            available in an event.
        cloud:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCloud'
          nullable: true
          description: >-
            Describes details about the Cloud environment where the event was
            originally created or logged.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence, normalized to the caption of the confidence_id
            value. In the case of 'Other', it is defined by the event source.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of the rule that
            created the finding. A rule with a low confidence means that the
            finding scope is wide and may create finding reports that may not be
            malicious in nature.
        confidence_score:
          type: integer
          nullable: true
          description: The confidence score as reported by the event source.
        connection_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkConnectionInfo'
          nullable: true
          description: The network connection information.
        count:
          type: integer
          nullable: true
          description: >-
            The number of times that events in the same logical group occurred
            during the event <strong>Start Time</strong> to <strong>End
            Time</strong> period.
        custom_fields:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: A list of custom fields
        device:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDevice'
          nullable: true
          description: An addressable device, computer system or host.
        disposition:
          type: string
          nullable: true
          description: >-
            The disposition name, normalized to the caption of the
            disposition_id value. In the case of 'Other', it is defined by the
            event source.
        disposition_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDispositionId'
          nullable: true
          description: >-
            Describes the outcome or action taken by a security control, such as
            access control checks, malware detections or various types of policy
            violations.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkEndpoint'
          nullable: true
          description: The responder (server) in a network connection.
        duration:
          type: integer
          nullable: true
          description: >-
            The event duration or aggregate time, the amount of time the event
            covers from <code>start_time</code> to <code>end_time</code> in
            milliseconds.
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The end time of a time period, or the time of the most recent event
            included in the aggregate event.
        enrichments:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEnrichment'
          nullable: true
          description: >-
            The additional information from an external data source, which is
            associated with the event or a finding. For example add location
            information for the IP address in the DNS
            answers:<p></p><code>[{"name": "answers.ip", "value":
            "92.24.47.250", "type": "location", "data": {"city": "Socotra",
            "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country":
            "YE", "desc": "Yemen"}}]</code>
        file:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          nullable: true
          description: The file that is the target of the HTTP activity.
        firewall_rule:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFirewallRule'
          nullable: true
          description: >-
            The firewall rule that pertains to the control that triggered the
            event, if applicable.
        http_cookies:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpCookie'
          nullable: true
          description: The cookies object describes details about HTTP cookies
        http_request:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpRequest'
          nullable: true
          description: >-
            The HTTP Request Object documents attributes of a request made to a
            web server.
        http_response:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpResponse'
          nullable: true
          description: The HTTP Response from a web server to a requester.
        http_status:
          type: integer
          nullable: true
          description: >-
            The Hypertext Transfer Protocol (HTTP) <a target="_blank"
            href="https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml">status
            code</a> returned to the client.
        is_alert:
          type: boolean
          nullable: true
          description: >-
            Indicates that the event is considered to be an alertable signal.
            Should be set to <code>true</code> if <code>disposition_id =
            Alert</code> among other dispositions, and/or
            <code>risk_level_id</code> or <code>severity_id</code> of the event
            is elevated. Not all control events will be alertable, for example
            if <code>disposition_id = Exonerated</code> or <code>disposition_id
            = Allowed</code>.
        ja4_fingerprint_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityJa4Fingerprint'
          nullable: true
          description: A list of the JA4+ network fingerprints.
        load_balancer:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLoadBalancer'
          nullable: true
          description: >-
            The Load Balancer object contains information related to the device
            that is distributing incoming traffic to specified destinations.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        malware_scan_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMalwareScanInfo'
          nullable: true
          description: >-
            Describes details about the scan job that identified malware on the
            target system.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        metadata:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMetadata'
          description: The metadata associated with the event or a finding.
        observables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityObservable'
          nullable: true
          description: The observables associated with the event or a finding.
        osint:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityOsint'
          nullable: true
          description: >-
            The OSINT (Open Source Intelligence) object contains details related
            to an indicator such as the indicator itself, related indicators,
            geolocation, registrar information, subdomains, analyst commentary,
            and other contextual information. This information can be used to
            further enrich a detection or finding by providing decisioning
            support to other analysts and engineers.
        policy:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPolicy'
          nullable: true
          description: >-
            The policy that pertains to the control that triggered the event, if
            applicable. For example the name of an anti-malware policy or an
            access control policy.
        proxy:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_connection_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkConnectionInfo'
          nullable: true
          description: >-
            The connection information from the proxy server to the remote
            server.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkProxy'
          nullable: true
          description: The proxy (server) in a network connection.
        proxy_http_request:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpRequest'
          nullable: true
          description: The HTTP Request from the proxy server to the remote server.
        proxy_http_response:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpResponse'
          nullable: true
          description: The HTTP Response from the remote server to the proxy server.
        proxy_tls:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTls'
          nullable: true
          description: >-
            The TLS protocol negotiated between the proxy server and the remote
            server.
        proxy_traffic:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkTraffic'
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network, from proxy to remote server at a given point of time.
        raw_data:
          type: string
          nullable: true
          description: The raw event/finding data as received from the source.
        raw_data_hash:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: The hash, which describes the content of the raw_data field.
        raw_data_size:
          type: integer
          nullable: true
          description: >-
            The size of the raw data which was transformed into an OCSF event,
            in bytes.
        risk_details:
          type: string
          nullable: true
          description: Describes the risk associated with the finding.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityRiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        severity:
          type: string
          nullable: true
          description: >-
            The event/finding severity, normalized to the caption of the
            <code>severity_id</code> value. In the case of 'Other', it is
            defined by the source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySeverityId'
          description: >-
            <p>The normalized identifier of the event/finding severity.</p>The
            normalized severity is a measurement the effort and expense required
            to manage and resolve an event or incident. Smaller numerical values
            represent lower impact events, and larger numerical values represent
            higher impact events.
        src_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkEndpoint'
          nullable: true
          description: The initiator (client) of the network connection.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The start time of a time period, or the time of the least recent
            event included in the aggregate event.
        status:
          type: string
          nullable: true
          description: >-
            The event status, normalized to the caption of the status_id value.
            In the case of 'Other', it is defined by the event source.
        status_code:
          type: string
          nullable: true
          description: >-
            The event status code, as reported by the event source.<br /><br
            />For example, in a Windows Failed Authentication event, this would
            be the value of 'Failure Code', e.g. 0x18.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional information about the
            event/finding outcome.
        status_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityStatusId'
          nullable: true
          description: The normalized identifier of the event status.
        time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          description: The normalized event occurrence time or the finding creation time.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: The normalized event occurrence time or the finding creation time.
        timezone_offset:
          type: integer
          nullable: true
          description: >-
            The number of minutes that the reported event <code>time</code> is
            ahead or behind UTC, in the range -1,080 to +1,080.
        tls:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTls'
          nullable: true
          description: The Transport Layer Security (TLS) attributes.
        traffic:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkTraffic'
          nullable: true
          description: >-
            The network traffic refers to the amount of data moving across a
            network at a given point of time. Intended to be used alongside
            Network Connection.
        type_name:
          type: string
          nullable: true
          description: The event/finding type name, as defined by the type_uid.
        type_uid:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTypeUid'
          description: >-
            The event/finding type ID. It identifies the event's semantics and
            structure. The value is calculated by the logging system as:
            <code>class_uid \* 100 + activity_id</code>.
        unmapped:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            The attributes that are not mapped to the event schema. The names
            and values of those attributes are specific to the event source.
      required:
        - activity_id
        - category_uid
        - class_uid
        - metadata
        - severity_id
        - time
        - type_uid
    ocsfv1.6.0httpactivityRiskLevelId:
      title: ocsfv1.6.0httpactivityRiskLevelId
      type: integer
      description: >-
        RiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivitySeverityId:
      title: ocsfv1.6.0httpactivitySeverityId
      type: integer
      description: >-
        SeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityStatusId:
      title: ocsfv1.6.0httpactivityStatusId
      type: integer
      description: >-
        StatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Success

        2 - Failure

        99 - Other: The status is not mapped. See the <code>status</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityTypeUid:
      title: ocsfv1.6.0httpactivityTypeUid
      type: integer
      description: >-
        TypeUid is an enum, and the following values are allowed.

        400200 - Unknown

        400201 - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        400202 - Delete: The DELETE method deletes the specified resource.

        400203 - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        400204 - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        400205 - Options: The OPTIONS method describes the communication options
        for the target resource.

        400206 - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        400207 - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        400208 - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.

        400209 - Patch: The PATCH method applies partial modifications to a
        resource.

        400299 - Other
    ocsfv1.6.0httpactivityAccount:
      title: ocsfv1.6.0httpactivityAccount
      type: object
      description: >-
        The Account object contains details about the account that initiated or
        performed a specific activity within a system or application.
        Additionally, the Account object refers to logical Cloud and
        Software-as-a-Service (SaaS) based containers such as AWS Accounts,
        Azure Subscriptions, Oracle Cloud Compartments, Google Cloud Projects,
        and otherwise.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the account.
        name:
          type: string
          nullable: true
          description: >-
            The name of the account (e.g. <code> GCP Project name </code>,
            <code> Linux Account name </code> or <code> AWS Account
            name</code>).
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            account.
        type:
          type: string
          nullable: true
          description: >-
            The account type, normalized to the caption of 'account_type_id'. In
            the case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAccount_TypeId'
          nullable: true
          description: The normalized account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the account (e.g. <code> AWS Account ID
            </code>, <code> OCID </code>, <code> GCP Project ID </code>, <code>
            Azure Subscription ID </code>, <code> Google Workspace Customer ID
            </code>, or <code> M365 Tenant UID</code>).
    ocsfv1.6.0httpactivityAccount_TypeId:
      title: ocsfv1.6.0httpactivityAccount_TypeId
      type: integer
      description: |-
        AccountTypeId is an enum, and the following values are allowed.
        0 - Unknown: The account type is unknown.
        1 - LDAPAccount
        2 - WindowsAccount
        3 - AWSIAMUser
        4 - AWSIAMRole
        5 - GCPAccount
        6 - AzureADAccount
        7 - MacOSAccount
        8 - AppleAccount
        9 - LinuxAccount
        10 - AWSAccount
        11 - GCPProject
        12 - OCICompartment
        13 - AzureSubscription
        14 - SalesforceAccount
        15 - GoogleWorkspace
        16 - ServicenowInstance
        17 - M365Tenant
        18 - EmailAccount
        99 - Other: The account type is not mapped.
    ocsfv1.6.0httpactivityActor:
      title: ocsfv1.6.0httpactivityActor
      type: object
      description: >-
        The Actor object contains details about the user, role, application,
        service, or process that initiated or performed a specific activity.
        Note that Actor is not the threat actor of a campaign but may be part of
        a campaign.
      properties:
        actor_type:
          type: string
          nullable: true
          description: >-
            The actor type, normalized to the caption of the actor_type_id
            value. In the case of 'Other', it is defined by the data source.
        actor_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityActor_ActorTypeId'
          nullable: true
          description: The normalized identifier of the actor type.
        app_name:
          type: string
          nullable: true
          description: >-
            The client application or service that initiated the activity. This
            can be in conjunction with the <code>user</code> if present. Note
            that <code>app_name</code> is distinct from the <code>process</code>
            if present.
        app_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the client application or service that
            initiated the activity. This can be in conjunction with the
            <code>user</code> if present. Note that <code>app_name</code> is
            distinct from the <code>process.pid</code> or
            <code>process.uid</code> if present.
        authorizations:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAuthorization'
          nullable: true
          description: >-
            Provides details about an authorization, such as authorization
            outcome, and any associated policies related to the activity/event.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityGroup'
          nullable: true
          description: >-
            Groups which are pertinent to the action. For example, the team name
            for Teams, where the user may not necessarily be a member of the
            group, but it is still relevant to the action taken.
        idp:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIdp'
          nullable: true
          description: This object describes details about the Identity Provider used.
        invoked_by:
          type: string
          nullable: true
          description: >-
            The name of the service that invoked the activity as described in
            the event.
        process:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProcess'
          nullable: true
          description: The process that initiated the activity.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySession'
          nullable: true
          description: The user session from which the activity was initiated.
        user:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: >-
            The user that initiated the activity or the user context from which
            the activity was initiated.
    ocsfv1.6.0httpactivityActor_ActorTypeId:
      title: ocsfv1.6.0httpactivityActor_ActorTypeId
      type: integer
      description: >-
        ActorActorTypeId is an enum, and the following values are allowed.

        0 - Unknown: The actor type is unknown.

        1 - Internal: Internal actor.

        2 - Guest: Guest actor.

        3 - Federated: Federated actor.

        99 - Other: The actor type is not mapped. See the actor_type attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityAdvisory:
      title: ocsfv1.6.0httpactivityAdvisory
      type: object
      description: >-
        The Advisory object represents publicly disclosed cybersecurity
        vulnerabilities defined in a Security advisory. e.g. <code> Microsoft KB
        Article</code>, <code>Apple Security Advisory</code>, or a <code>GitHub
        Security Advisory (GHSA)</code>
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The Advisory bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the Advisory.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the Advisory record was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was created.
        desc:
          type: string
          nullable: true
          description: A brief description of the Advisory Record.
        install_state:
          type: string
          nullable: true
          description: The install state of the Advisory.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAdvisory_InstallStateId'
          nullable: true
          description: The normalized install state ID of the Advisory.
        is_superseded:
          type: boolean
          nullable: true
          description: The Advisory has been replaced by another.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the Advisory record was last updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the Advisory record was last updated.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOs'
          nullable: true
          description: The operating system the Advisory applies to.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerabilities disclosed in the Advisory.
        related_cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityCve'
          nullable: true
          description: >-
            A list of Common Vulnerabilities and Exposures <a target="_blank"
            href="https://cve.mitre.org/">(CVE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityCwe'
          nullable: true
          description: >-
            A list of Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> identifiers related to the
            vulnerabilities disclosed in the Advisory.
        size:
          type: integer
          nullable: true
          description: >-
            The size in bytes for the Advisory. Usually populated for a KB
            Article patch.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: The Advisory link from the source vendor.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the Advisory.
        uid:
          type: string
          description: >-
            The unique identifier assigned to the advisory or disclosed
            vulnerability, e.g, <code>GHSA-5mrr-rgp6-x4gr</code>.
      required:
        - uid
    ocsfv1.6.0httpactivityAdvisory_InstallStateId:
      title: ocsfv1.6.0httpactivityAdvisory_InstallStateId
      type: integer
      description: >-
        AdvisoryInstallStateId is an enum, and the following values are allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityAffectedCode:
      title: ocsfv1.6.0httpactivityAffectedCode
      type: object
      description: >-
        The Affected Code object describes details about a code block identified
        as vulnerable.
      properties:
        end_column:
          type: integer
          nullable: true
          description: >-
            The column number of the last part of the assessed code identified
            as vulnerable.
        end_line:
          type: integer
          nullable: true
          description: >-
            The line number of the last line of code block identified as
            vulnerable.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          description: Details about the file that contains the affected code block.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: Details about the user that owns the affected file.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        rule:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityRule'
          nullable: true
          description: >-
            Details about the specific rule, e.g., those defined as part of a
            larger <code>policy</code>, that triggered the finding.
        start_column:
          type: integer
          nullable: true
          description: >-
            The column number of the first part of the assessed code identified
            as vulnerable.
        start_line:
          type: integer
          nullable: true
          description: >-
            The line number of the first line of code block identified as
            vulnerable.
      required:
        - file
    ocsfv1.6.0httpactivityAffectedPackage:
      title: ocsfv1.6.0httpactivityAffectedPackage
      type: object
      description: >-
        The Affected Package object describes details about a software package
        identified as affected by a vulnerability/vulnerabilities.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        fixed_in_version:
          type: string
          nullable: true
          description: >-
            The software package version in which a reported vulnerability was
            patched/fixed.
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        path:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFilePath'
          nullable: true
          description: The installation path of the affected package.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityRemediation'
          nullable: true
          description: >-
            Describes the recommended remediation steps to address identified
            issue(s).
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAffectedPackage_TypeId'
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.6.0httpactivityAffectedPackage_TypeId:
      title: ocsfv1.6.0httpactivityAffectedPackage_TypeId
      type: integer
      description: >-
        AffectedPackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityAgent:
      title: ocsfv1.6.0httpactivityAgent
      type: object
      description: >-
        An Agent (also known as a Sensor) is typically installed on an Operating
        System (OS) and serves as a specialized software component that can be
        designed to monitor, detect, collect, archive, or take action. These
        activities and possible actions are defined by the upstream system
        controlling the Agent and its intended purpose. For instance, an Agent
        can include Endpoint Detection &amp; Response (EDR) agents,
        backup/disaster recovery sensors, Application Performance Monitoring or
        profiling sensors, and similar software.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the agent or sensor. For example: <code>AWS SSM
            Agent</code>.
        type:
          type: string
          nullable: true
          description: >-
            The normalized caption of the type_id value for the agent or sensor.
            In the case of 'Other' or 'Unknown', it is defined by the event
            source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAgent_TypeId'
          nullable: true
          description: >-
            The normalized representation of an agent or sensor. E.g., EDR,
            vulnerability management, APM, backup & recovery, etc.
        uid:
          type: string
          nullable: true
          description: >-
            The UID of the agent or sensor, sometimes known as a Sensor ID or
            <code>aid</code>.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternative or contextual identifier for the agent or sensor,
            such as a configuration, organization, or license UID.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The company or author who created the agent or sensor. For example:
            <code>Crowdstrike</code>.
        version:
          type: string
          nullable: true
          description: >-
            The semantic version of the agent or sensor, e.g.,
            <code>7.101.50.0</code>.
    ocsfv1.6.0httpactivityAgent_TypeId:
      title: ocsfv1.6.0httpactivityAgent_TypeId
      type: integer
      description: >-
        AgentTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - EndpointDetectionandResponse: Any EDR sensor or agent. Or any tool
        that provides similar threat detection, anti-malware, anti-ransomware,
        or similar capabilities. E.g., Crowdstrike Falcon, Microsoft Defender
        for Endpoint, Wazuh.

        2 - DataLossPrevention: Any DLP sensor or agent. Or any tool that
        provides similar data classification, data loss detection, and/or data
        loss prevention capabilities. E.g., Forcepoint DLP, Microsoft Purview,
        Symantec DLP.

        3 - Recovery: Any agent or sensor that provides backups, archival, or
        recovery capabilities. E.g., Azure Backup, AWS Backint Agent.

        4 - Observability: Any agent or sensor that provides Application
        Performance Monitoring (APM), active tracing, profiling, or other
        observability use cases and optionally forwards the logs. E.g., New
        Relic Agent, Datadog Agent, Azure Monitor Agent.

        5 - VulnerabilityManagement: Any agent or sensor that provides
        vulnerability management or scanning capabilities. E.g., Qualys VMDR,
        Microsoft Defender for Endpoint, Crowdstrike Spotlight, Amazon Inspector
        Agent.

        6 - LogForwarding: Any agent or sensor that forwards logs to a 3rd party
        storage system such as a data lake or SIEM. E.g., Splunk Universal
        Forwarder, Tenzir, FluentBit, Amazon CloudWatch Agent, Amazon Kinesis
        Agent.

        7 - MobileDeviceManagement: Any agent or sensor responsible for
        providing Mobile Device Management (MDM) or Mobile Enterprise Management
        (MEM) capabilities. E.g., JumpCloud Agent, Esper Agent, Jamf Pro binary.

        8 - ConfigurationManagement: Any agent or sensor that provides
        configuration management of a device, such as scanning for software,
        license management, or applying configurations. E.g., AWS Systems
        Manager Agent, Flexera, ServiceNow MID Server.

        9 - RemoteAccess: Any agent or sensor that provides remote access
        capabilities to a device. E.g., BeyondTrust, Amazon Systems Manager
        Agent, Verkada Agent.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityAnalytic:
      title: ocsfv1.6.0httpactivityAnalytic
      type: object
      description: >-
        The Analytic object contains details about the analytic technique used
        to analyze and derive insights from the data or information that led to
        the creation of a finding or conclusion.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The algorithm used by the underlying analytic to generate the
            finding.
        category:
          type: string
          nullable: true
          description: The analytic category.
        desc:
          type: string
          nullable: true
          description: The description of the analytic that generated the finding.
        name:
          type: string
          nullable: true
          description: The name of the analytic that generated the finding.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: Other analytics related to this analytic.
        state:
          type: string
          nullable: true
          description: The Analytic state.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAnalytic_StateId'
          nullable: true
          description: The Analytic state identifier.
        type:
          type: string
          nullable: true
          description: The analytic type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAnalytic_TypeId'
          description: The analytic type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the analytic that generated the finding.
        version:
          type: string
          nullable: true
          description: 'The analytic version. For example: <code>1.1</code>.'
      required:
        - type_id
    ocsfv1.6.0httpactivityAnalytic_StateId:
      title: ocsfv1.6.0httpactivityAnalytic_StateId
      type: integer
      description: >-
        AnalyticStateId is an enum, and the following values are allowed.

        0 - Unknown: The state is unknown.

        1 - Active: The Analytic is active.

        2 - Suppressed: The Analytic is suppressed. For example, a user/customer
        has suppressed a particular detection signature in a security product.

        3 - Experimental: The Analytic is still under development and considered
        experimental.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityAnalytic_TypeId:
      title: ocsfv1.6.0httpactivityAnalytic_TypeId
      type: integer
      description: >-
        AnalyticTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Rule: A Rule in security analytics refers to predefined criteria or
        conditions set to monitor, alert, or enforce policies, playing a crucial
        role in access control, threat detection, and regulatory compliance
        across security systems.

        2 - Behavioral: Behavioral analytics focus on monitoring and analyzing
        user or system actions to identify deviations from established patterns,
        aiding in the detection of insider threats, fraud, and advanced
        persistent threats (APTs).

        3 - Statistical: Statistical analytics pertains to analyzing data
        patterns and anomalies using statistical models to predict, detect, and
        respond to potential threats, enhancing overall security posture through
        informed decision-making.

        4 - ML*DL*: Learning (ML/DL) encompasses techniques that can "learn"
        from known data to create analytics that generalize to new data. There
        may be a statistical component to these techniques, but it is not a
        requirement.

        5 - Fingerprinting: Fingerprinting is the technique of collecting
        detailed system data, including software versions and configurations, to
        enhance threat detection, data loss prevention (DLP), and endpoint
        detection and response (EDR) capabilities.

        6 - Tagging: Tagging refers to the practice of assigning labels or
        identifiers to data, users, assets, or activities to monitor, control
        access, and facilitate incident response across various security domains
        such as DLP and EDR.

        7 - KeywordMatch: Keyword Match involves scanning content for specific
        terms to identify sensitive information, potential threats, or policy
        violations, aiding in DLP and compliance monitoring.

        8 - RegularExpressions: Regular Expressions are used to define complex
        search patterns for identifying, validating, and extracting specific
        data sets or threats within digital content, enhancing DLP, EDR, and
        threat detection mechanisms.

        9 - ExactDataMatch: Exact Data Match is a precise comparison technique
        used to detect the unauthorized use or exposure of specific, sensitive
        information, crucial for enforcing DLP policies and protecting against
        data breaches.

        10 - PartialDataMatch: Partial Data Match involves identifying instances
        where segments of sensitive information or patterns match, facilitating
        nuanced DLP and threat detection without requiring complete data
        conformity.

        11 - IndexedDataMatch: Indexed Data Match refers to comparing content
        against a pre-compiled index of sensitive information to efficiently
        detect and prevent unauthorized access or breaches, streamlining DLP and
        compliance efforts.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityApi:
      title: ocsfv1.6.0httpactivityApi
      type: object
      description: >-
        The API, or Application Programming Interface, object represents
        information pertaining to an API request and response.
      properties:
        group:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityGroup'
          nullable: true
          description: The information pertaining to the API group.
        operation:
          type: string
          description: Verb/Operation associated with the request
        request:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityRequest'
          nullable: true
          description: Details pertaining to the API request.
        response:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityResponse'
          nullable: true
          description: Details pertaining to the API response.
        service:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityService'
          nullable: true
          description: The information pertaining to the API service.
        version:
          type: string
          nullable: true
          description: The version of the API service.
      required:
        - operation
    ocsfv1.6.0httpactivityAttack:
      title: ocsfv1.6.0httpactivityAttack
      type: object
      description: >-
        The MITRE ATT&amp;CK® &amp; ATLAS™ object describes the tactic,
        technique, sub-technique &amp; mitigation associated to an attack.
      properties:
        mitigation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMitigation'
          nullable: true
          description: >-
            The Mitigation object describes the MITRE ATT&CK® or ATLAS™
            Mitigation ID and/or name that is associated to an attack.
        sub_technique:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySubTechnique'
          nullable: true
          description: >-
            The Sub-technique object describes the MITRE ATT&CK® or ATLAS™
            Sub-technique ID and/or name associated to an attack.
        tactic:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the MITRE ATT&CK® or ATLAS™ Tactic ID
            and/or name that is associated to an attack.
        tactics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or tactic name that
            are associated with the attack technique, as defined by <a
            target="_blank"
            href="https://attack.mitre.org/wiki/ATT&amp;CK_Matrix">ATT&amp;CK®
            Matrix</a>.
        technique:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTechnique'
          nullable: true
          description: >-
            The Technique object describes the MITRE ATT&CK® or ATLAS™ Technique
            ID and/or name associated to an attack.
        version:
          type: string
          nullable: true
          description: The ATT&amp;CK® or ATLAS™ Matrix version.
    ocsfv1.6.0httpactivityAuthFactor:
      title: ocsfv1.6.0httpactivityAuthFactor
      type: object
      description: >-
        An Authentication Factor object describes a category of methods used for
        identity verification in an authentication attempt.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDevice'
          nullable: true
          description: Device used to complete an authentication request.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The email address used in an email-based authentication factor.
        factor_type:
          type: string
          nullable: true
          description: The type of authentication factor used in an authentication attempt.
        factor_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAuthFactor_FactorTypeId'
          description: The normalized identifier for the authentication factor.
        is_hotp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is an HMAC-based One-time Password
            (HOTP).
        is_totp:
          type: boolean
          nullable: true
          description: >-
            Whether the authentication factor is a Time-based One-time Password
            (TOTP).
        phone_number:
          type: string
          nullable: true
          description: The phone number used for a telephony-based authentication request.
        provider:
          type: string
          nullable: true
          description: The name of provider for an authentication factor.
        security_questions:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The question(s) provided to user for a question-based authentication
            factor.
      required:
        - factor_type_id
    ocsfv1.6.0httpactivityAuthFactor_FactorTypeId:
      title: ocsfv1.6.0httpactivityAuthFactor_FactorTypeId
      type: integer
      description: >-
        AuthFactorFactorTypeId is an enum, and the following values are allowed.

        0 - Unknown

        1 - SMS: User receives and inputs a code sent to their mobile device via
        SMS text message.

        2 - SecurityQuestion: The user responds to a security question as part
        of a question-based authentication factor

        3 - PhoneCall: System calls the user's registered phone number and
        requires the user to answer and provide a response.

        4 - Biometric: Devices that verify identity-based on user's physical
        identifiers, such as fingerprint scanners or retina scanners.

        5 - PushNotification: Push notification is sent to user's registered
        device and requires the user to acknowledge.

        6 - HardwareToken: Physical device that generates a code to be used for
        authentication.

        7 - OTP: Application generates a one-time password (OTP) for use in
        authentication.

        8 - Email: A code or link is sent to a user's registered email address.

        9 - U2F: Typically involves a hardware token, which the user physically
        interacts with to authenticate.

        10 - WebAuthn: Web-based API that enables users to register devices as
        authentication factors.

        11 - Password: The user enters a password that they have previously
        established.

        99 - Other
    ocsfv1.6.0httpactivityAuthorization:
      title: ocsfv1.6.0httpactivityAuthorization
      type: object
      description: >-
        The Authorization Result object provides details about the authorization
        outcome and associated policies related to activity.
      properties:
        decision:
          type: string
          nullable: true
          description: Authorization Result/outcome, e.g. allowed, denied.
        policy:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPolicy'
          nullable: true
          description: >-
            Details about the Identity/Access management policies that are
            applicable.
    ocsfv1.6.0httpactivityAutonomousSystem:
      title: ocsfv1.6.0httpactivityAutonomousSystem
      type: object
      description: >-
        An autonomous system (AS) is a collection of connected Internet Protocol
        (IP) routing prefixes under the control of one or more network operators
        on behalf of a single administrative entity or domain that presents a
        common, clearly defined routing policy to the internet.
      properties:
        name:
          type: string
          nullable: true
          description: Organization name for the Autonomous System.
        number:
          type: integer
          nullable: true
          description: Unique number that the AS is identified by.
    ocsfv1.6.0httpactivityCampaign:
      title: ocsfv1.6.0httpactivityCampaign
      type: object
      description: >-
        Campaign represent organized efforts by threat actors to achieve
        malicious objectives over a period, often characterized by shared
        tactics, techniques, and procedures (TTPs).
      properties:
        name:
          type: string
          description: The name of a specific campaign associated with a cyber threat.
      required:
        - name
    ocsfv1.6.0httpactivityCertificate:
      title: ocsfv1.6.0httpactivityCertificate
      type: object
      description: >-
        The Digital Certificate, also known as a Public Key Certificate, object
        contains information about the ownership and usage of a public key. It
        serves as a means to establish trust in the authenticity and integrity
        of the public key and the associated entity.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the certificate was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the certificate was created.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The expiration time of the certificate.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the certificate.
        fingerprints:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: The fingerprint list of the certificate.
        is_self_signed:
          type: boolean
          nullable: true
          description: >-
            Denotes whether a digital certificate is self-signed or signed by a
            known certificate authority (CA).
        issuer:
          type: string
          description: The certificate issuer distinguished name.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        serial_number:
          type: string
          description: >-
            The serial number of the certificate used to create the digital
            signature.
        subject:
          type: string
          nullable: true
          description: The certificate subject distinguished name.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the certificate.
        version:
          type: string
          nullable: true
          description: The certificate version.
      required:
        - issuer
        - serial_number
    ocsfv1.6.0httpactivityCisControl:
      title: ocsfv1.6.0httpactivityCisControl
      type: object
      description: >-
        The CIS Control (aka Critical Security Control) object describes a
        prioritized set of actions to protect your organization and data from
        cyber-attack vectors. The <a target="_blank"
        href="https://www.cisecurity.org/controls">CIS Controls</a> are defined
        by the Center for Internet Security.
      properties:
        desc:
          type: string
          nullable: true
          description: >-
            The CIS Control description. For example: <i>Uninstall or disable
            unnecessary services on enterprise assets and software, such as an
            unused file sharing service, web application module, or service
            function.</i>
        name:
          type: string
          description: >-
            The CIS Control name. For example: <i>4.8 Uninstall or Disable
            Unnecessary Services on Enterprise Assets and Software.</i>
        version:
          type: string
          nullable: true
          description: 'The CIS Control version. For example: <i>v8</i>.'
      required:
        - name
    ocsfv1.6.0httpactivityCloud:
      title: ocsfv1.6.0httpactivityCloud
      type: object
      description: >-
        The Cloud object contains information about a cloud or
        Software-as-a-Service account or similar construct, such as AWS Account
        ID, regions, organizations, folders, compartments, tenants, etc.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAccount'
          nullable: true
          description: >-
            The account object describes details about the account that was the
            source or target of the activity.
        cloud_partition:
          type: string
          nullable: true
          description: >-
            The canonical cloud partition name to which the region is assigned
            (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).
        org:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOrganization'
          nullable: true
          description: Organization and org unit relevant to the event or object.
        project_uid:
          type: string
          nullable: true
          description: The unique identifier of a Cloud project.
        provider:
          type: string
          description: >-
            The unique name of the Cloud services provider, such as AWS, MS
            Azure, GCP, etc.
        region:
          type: string
          nullable: true
          description: The name of the cloud region, as defined by the cloud provider.
        zone:
          type: string
          nullable: true
          description: >-
            The availability zone in the cloud region, as defined by the cloud
            provider.
      required:
        - provider
    ocsfv1.6.0httpactivityContainer:
      title: ocsfv1.6.0httpactivityContainer
      type: object
      description: >-
        The Container object describes an instance of a specific container. A
        container is a prepackaged, portable system image that runs isolated on
        an existing system using a container runtime like containerd.
      properties:
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: >-
            Commit hash of image created for docker or the SHA256 hash of the
            container. For example:
            <code>13550340a8681c84c861aac2e5b440161c2b33a3e4f302ac680ca5b686de48de</code>.
        image:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityImage'
          nullable: true
          description: The container image used as a template to run the container.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the container.
        name:
          type: string
          nullable: true
          description: The container name.
        network_driver:
          type: string
          nullable: true
          description: >-
            The network driver used by the container. For example, bridge,
            overlay, host, none, etc.
        orchestrator:
          type: string
          nullable: true
          description: >-
            The orchestrator managing the container, such as ECS, EKS, K8s, or
            OpenShift.
        pod_uuid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the pod (or equivalent) that the container
            is executing on.
        runtime:
          type: string
          nullable: true
          description: The backend running the container, such as containerd or cri-o.
        size:
          type: integer
          nullable: true
          description: The size of the container image.
        tag:
          type: string
          nullable: true
          description: The tag used by the container. It can indicate version, format, OS.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            container.
        uid:
          type: string
          nullable: true
          description: >-
            The full container unique identifier for this instantiation of the
            container. For example:
            <code>ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf</code>.
    ocsfv1.6.0httpactivityCve:
      title: ocsfv1.6.0httpactivityCve
      type: object
      description: >-
        The Common Vulnerabilities and Exposures (CVE) object represents
        publicly disclosed cybersecurity vulnerabilities defined in CVE Program
        catalog (<a target="_blank" href="https://cve.mitre.org/">CVE</a>).
        There is one CVE Record for each vulnerability in the catalog.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Creation Date identifies when the CVE ID was issued to a
            CVE Numbering Authority (CNA) or the CVE Record was published on the
            CVE List. Note that the Record Creation Date does not necessarily
            indicate when this vulnerability was discovered, shared with the
            affected vendor, publicly disclosed, or updated in CVE.
        cvss:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityCvss'
          nullable: true
          description: >-
            The CVSS object details Common Vulnerability Scoring System (<a
            target="_blank" href="https://www.first.org/cvss/">CVSS</a>) scores
            from the advisory that are related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCwe'
          nullable: true
          description: >-
            The CWE object represents a weakness in a software system that can
            be exploited by a threat actor to perform an attack. The CWE object
            is based on the <a target='_blank'
            href='https://cwe.mitre.org/'>Common Weakness Enumeration (CWE)</a>
            catalog.
        cwe_uid:
          type: string
          nullable: true
          description: >-
            The <a target="_blank" href="https://cwe.mitre.org/">Common Weakness
            Enumeration (CWE)</a> unique identifier. For example:
            <code>CWE-787</code>.
        cwe_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            Common Weakness Enumeration (CWE) definition URL. For example:
            <code>https://cwe.mitre.org/data/definitions/787.html</code>.
        desc:
          type: string
          nullable: true
          description: A brief description of the CVE Record.
        epss:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEpss'
          nullable: true
          description: >-
            The Exploit Prediction Scoring System (EPSS) object describes the
            estimated probability a vulnerability will be exploited. EPSS is a
            community-driven effort to combine descriptive information about
            vulnerabilities (CVEs) with evidence of actual exploitation
            in-the-wild. (<a target='_blank'
            href='https://www.first.org/epss/'>EPSS</a>).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The Record Modified Date identifies when the CVE record was last
            updated.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: The product where the vulnerability was discovered.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the CVE
            Record.
        related_cwes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target="_blank"
            href="https://cwe.mitre.org/">(CWE)</a> details related to the CVE
            Record.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the CVE record.
        type:
          type: string
          nullable: true
          description: >-
            <p>The vulnerability type as selected from a large dropdown menu
            during CVE refinement.</p>Most frequently used vulnerability types
            are: <code>DoS</code>, <code>Code Execution</code>,
            <code>Overflow</code>, <code>Memory Corruption</code>, <code>Sql
            Injection</code>, <code>XSS</code>, <code>Directory
            Traversal</code>, <code>Http Response Splitting</code>, <code>Bypass
            something</code>, <code>Gain Information</code>, <code>Gain
            Privileges</code>, <code>CSRF</code>, <code>File Inclusion</code>.
            For more information see <a target="_blank"
            href="https://www.cvedetails.com/vulnerabilities-by-types.php">Vulnerabilities
            By Type</a> distributions.
        uid:
          type: string
          description: >-
            The Common Vulnerabilities and Exposures unique number assigned to a
            specific computer vulnerability. A CVE Identifier begins with 4
            digits representing the year followed by a sequence of digits that
            acts as a unique identifier. For example:
            <code>CVE-2021-12345</code>.
      required:
        - uid
    ocsfv1.6.0httpactivityCvss:
      title: ocsfv1.6.0httpactivityCvss
      type: object
      description: >-
        The Common Vulnerability Scoring System (<a target="_blank"
        href="https://www.first.org/cvss/">CVSS</a>) object provides a way to
        capture the principal characteristics of a vulnerability and produce a
        numerical score reflecting its severity.
      properties:
        base_score:
          type: number
          format: double
          description: 'The CVSS base score. For example: <code>9.1</code>.'
        depth:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCvss_Depth'
          nullable: true
          description: >-
            The CVSS depth represents a depth of the equation used to calculate
            CVSS score.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityMetric'
          nullable: true
          description: >-
            The Common Vulnerability Scoring System metrics. This attribute
            contains information on the CVE's impact. If the CVE has been
            analyzed, this attribute will contain any CVSSv2 or CVSSv3
            information associated with the vulnerability. For example: <code>{
            {"Access Vector", "Network"}, {"Access Complexity", "Low"},
            ...}</code>.
        overall_score:
          type: number
          format: double
          nullable: true
          description: >-
            The CVSS overall score, impacted by base, temporal, and
            environmental metrics. For example: <code>9.1</code>.
        severity:
          type: string
          nullable: true
          description: >-
            <p>The Common Vulnerability Scoring System (CVSS) Qualitative
            Severity Rating. A textual representation of the numeric
            score.</p><strong>CVSS v2.0</strong><ul><li>Low (0.0 –
            3.9)</li><li>Medium (4.0 – 6.9)</li><li>High (7.0 –
            10.0)</li></ul><p></p><strong>CVSS v3.0</strong><ul><li>None
            (0.0)</li><li>Low (0.1 - 3.9)</li><li>Medium (4.0 -
            6.9)</li><li>High (7.0 - 8.9)</li><li>Critical (9.0 -
            10.0)</li></ul>
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The source URL for the CVSS score. For example:
            <code>https://nvd.nist.gov/vuln/detail/CVE-2021-44228</code>
        vector_string:
          type: string
          nullable: true
          description: >-
            The CVSS vector string is a text representation of a set of CVSS
            metrics. It is commonly used to record or transfer CVSS metric
            information in a concise form. For example:
            <code>3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</code>.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor that provided the CVSS score. For example: <code>NVD,
            REDHAT</code> etc.
        version:
          type: string
          description: 'The CVSS version. For example: <code>3.1</code>.'
      required:
        - base_score
        - version
    ocsfv1.6.0httpactivityCvss_Depth:
      title: ocsfv1.6.0httpactivityCvss_Depth
      type: string
      description: |-
        CvssDepth is an enum, and the following values are allowed.
        Base - Base
        Environmental - Environmental
        Temporal - Temporal
    ocsfv1.6.0httpactivityCwe:
      title: ocsfv1.6.0httpactivityCwe
      type: object
      description: >-
        The CWE object represents a weakness in a software system that can be
        exploited by a threat actor to perform an attack. The CWE object is
        based on the <a target="_blank" href="https://cwe.mitre.org/">Common
        Weakness Enumeration (CWE)</a> catalog.
      properties:
        caption:
          type: string
          nullable: true
          description: >-
            The caption assigned to the Common Weakness Enumeration unique
            identifier.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            URL pointing to the CWE Specification. For more information see <a
            target='_blank' href='https://cwe.mitre.org/'>CWE.</a>
        uid:
          type: string
          description: >-
            The Common Weakness Enumeration unique number assigned to a specific
            weakness. A CWE Identifier begins "CWE" followed by a sequence of
            digits that acts as a unique identifier. For example:
            <code>CWE-123</code>.
      required:
        - uid
    ocsfv1.6.0httpactivityD3fTactic:
      title: ocsfv1.6.0httpactivityD3fTactic
      type: object
      description: >-
        The MITRE D3FEND™ Tactic object describes the tactic ID and/or name that
        is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The tactic name that is associated with the defensive technique. For
            example: <code>Isolate</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the defensive tactic. For example:
            <code>https://d3fend.mitre.org/tactic/d3f:Isolate/</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the defensive tactic.
    ocsfv1.6.0httpactivityD3fTechnique:
      title: ocsfv1.6.0httpactivityD3fTechnique
      type: object
      description: >-
        The MITRE D3FEND™ Technique object describes the leaf defensive
        technique ID and/or name associated to a countermeasure.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the defensive technique. For example: <code>IO Port
            Restriction</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the defensive technique. For example:
            <code>https://d3fend.mitre.org/technique/d3f:IOPortRestriction/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the defensive technique. For example:
            <code>D3-IOPR</code>.
    ocsfv1.6.0httpactivityD3fend:
      title: ocsfv1.6.0httpactivityD3fend
      type: object
      description: >-
        The MITRE D3FEND™ object describes the tactic &amp; technique associated
        with a countermeasure.
      properties:
        d3f_tactic:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityD3fTactic'
          nullable: true
          description: >-
            The Tactic object describes the tactic ID and/or name that is
            associated with a countermeasure.
        d3f_technique:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityD3fTechnique'
          nullable: true
          description: >-
            The Technique object describes the technique ID and/or name
            associated with a countermeasure.
        version:
          type: string
          nullable: true
          description: The D3FEND™ Matrix version.
    ocsfv1.6.0httpactivityDevice:
      title: ocsfv1.6.0httpactivityDevice
      type: object
      description: >-
        The Device object represents an addressable computer system or host,
        which is typically connected to a computer network and participates in
        the transmission or processing of data within the computer network.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autoscale_uid:
          type: string
          nullable: true
          description: The unique identifier of the cloud autoscale configuration.
        boot_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time the system was booted.
        boot_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time the system was booted.
        boot_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier of the device that changes after every reboot.
            For example, the value of
            <code>/proc/sys/kernel/random/boot_id</code> from Linux's procfs.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the device was known to have been created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was known to have been created.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the device, ordinarily as reported by the
            operating system.
        domain:
          type: string
          nullable: true
          description: >-
            The network domain where the device resides. For example:
            <code>work.example.com</code>.
        eid:
          type: string
          nullable: true
          description: >-
            An Embedded Identity Document, is a unique serial number that
            identifies an eSIM-enabled device.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The initial discovery time of the device.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The initial discovery time of the device.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityGroup'
          nullable: true
          description: >-
            The group names to which the device belongs. For example:
            <code>["Windows Laptops", "Engineering"]</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHostname'
          nullable: true
          description: The device hostname.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        hypervisor:
          type: string
          nullable: true
          description: >-
            The name of the hypervisor running on the device. For example,
            <code>Xen</code>, <code>VMware</code>, <code>Hyper-V</code>,
            <code>VirtualBox</code>, etc.
        iccid:
          type: string
          nullable: true
          description: >-
            The Integrated Circuit Card Identification of a mobile device.
            Typically it is a unique 18 to 22 digit number that identifies a SIM
            card.
        image:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityImage'
          nullable: true
          description: The image used as a template to run the virtual machine.
        imei:
          type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity that is associated with
            the device.
        imei_list:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The International Mobile Equipment Identity values that are
            associated with the device.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: The device IP address, in either IPv4 or IPv6 format.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the device
        is_backed_up:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device or resource has a backup enabled, such
            as an automated snapshot or a cloud backup. For example, this is
            indicated by the <code>cloudBackupEnabled</code> value within JAMF
            Pro mobile devices or the registration of an AWS ARN with the AWS
            Backup service.
        is_compliant:
          type: boolean
          nullable: true
          description: The event occurred on a compliant device.
        is_managed:
          type: boolean
          nullable: true
          description: The event occurred on a managed device.
        is_mobile_account_active:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the device has an active mobile account. For
            example, this is indicated by the
            <code>itunesStoreAccountActive</code> value within JAMF Pro mobile
            devices.
        is_personal:
          type: boolean
          nullable: true
          description: The event occurred on a personal device.
        is_shared:
          type: boolean
          nullable: true
          description: The event occurred on a shared device.
        is_supervised:
          type: boolean
          nullable: true
          description: >-
            The event occurred on a supervised device. Devices that are
            supervised are typically mobile devices managed by a Mobile Device
            Management solution and are restricted from specific behaviors such
            as Apple AirDrop.
        is_trusted:
          type: boolean
          nullable: true
          description: The event occurred on a trusted device.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The most recent discovery time of the device.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent discovery time of the device.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLocation'
          nullable: true
          description: The geographical location of the device.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the device
        meid:
          type: string
          nullable: true
          description: >-
            The Mobile Equipment Identifier. It's a unique number that
            identifies a Code Division Multiple Access (CDMA) mobile device.
        model:
          type: string
          nullable: true
          description: >-
            The model of the device. For example <code>ThinkPad X1
            Carbon</code>.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the device was last known to have been modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the device was last known to have been modified.
        name:
          type: string
          nullable: true
          description: >-
            The alternate device name, ordinarily as assigned by an
            administrator. <p><b>Note:</b> The <b>Name</b> could be any other
            string that helps to identify the device, such as a phone number;
            for example <code>310-555-1234</code>.</p>
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        netbios_names:
          type: array
          items:
            type: string
          nullable: true
          description: A list of NetBIOS names available on the device
        network_interfaces:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkInterface'
          nullable: true
          description: >-
            The physical or virtual network interfaces that are associated with
            the device, one for each unique MAC address/IP address/hostname/name
            combination.<p><b>Note:</b> The first element of the array is the
            network information that pertains to the event.</p>
        network_status:
          type: string
          nullable: true
          description: The network isolation status of the endpoint
        network_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDevice_NetworkStatusId'
          nullable: true
          description: The network isolation status ID.
        org:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOrganization'
          nullable: true
          description: Organization and org unit related to the device.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOs'
          nullable: true
          description: The endpoint operating system.
        os_machine_uuid:
          type: string
          nullable: true
          description: >-
            The operating system assigned Machine ID. In Windows, this is the
            value stored at the registry path:
            <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid</code>.
            In Linux, this is stored in the file: <code>/etc/machine-id</code>.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        region:
          type: string
          nullable: true
          description: >-
            The region where the virtual machine is located. For example, an AWS
            Region.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDevice_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySubnet'
          nullable: true
          description: The subnet mask.
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        sw_info:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: The list of software contained on a device
        type:
          type: string
          nullable: true
          description: >-
            The device type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, <code>plc</code>, <code>scada</code>,
            <code>dcs</code>, <code>cnc</code>, <code>scientific</code>,
            <code>medical</code>, <code>lighting</code>, <code>energy</code>,
            <code>transportation</code> <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDevice_TypeId'
          description: The device type ID.
        udid:
          type: string
          nullable: true
          description: >-
            The Apple assigned Unique Device Identifier (UDID). For iOS, iPadOS,
            tvOS, watchOS and visionOS devices, this is the UDID. For macOS
            devices, it is the Provisioning UDID. For example:
            <code>00008020-008D4548007B4F26</code>
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the device. For example the Windows
            TargetSID or AWS EC2 ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            An alternate unique identifier of the device if any. For example the
            ActiveDirectory DN.
        vendor:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOrganization'
          nullable: true
          description: The product vendor that created the device.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor for the device. For example <code>Dell</code> or
            <code>Lenovo</code>.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
      required:
        - type_id
    ocsfv1.6.0httpactivityDevice_NetworkStatusId:
      title: ocsfv1.6.0httpactivityDevice_NetworkStatusId
      type: integer
      description: |-
        DeviceNetworkStatusId is an enum, and the following values are allowed.
        1 - NotIsolated: Device is not isolated from the network.
        2 - Isolated: Device is isolated from the network.
        3 - PendingIsolation: Device is pending isolation from the network.
        4 - PendingRestore: Device is pending restoration from isolation.
        99 - Unknown: The network isolation status is unknown.
    ocsfv1.6.0httpactivityDevice_RiskLevelId:
      title: ocsfv1.6.0httpactivityDevice_RiskLevelId
      type: integer
      description: >-
        DeviceRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityDevice_TypeId:
      title: ocsfv1.6.0httpactivityDevice_TypeId
      type: integer
      description: >-
        DeviceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        89 - ImagingEquipment: Equipment for processing optical data, such as a
        camera.

        90 - PLC: A Programmable logic controller.

        91 - SCADA: A supervisory control and data acquisition system.

        92 - DCS: A distributed control system.

        93 - CNC: A computer numerical control system, including computerized
        machine tools.

        94 - ScientificEquipment: A piece of scientific equipment such as an
        oscilloscope or spectrometer.

        95 - MedicalDevice: A medical device such as an MRI machine or infusion
        pump.

        96 - LightingControls: A lighting control for internal or external
        applications.

        97 - EnergyMonitoringSystem: An energy monitoring, security or safety
        system.

        98 - TransportationDevice: A transportation device or transportation
        supporting device.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityDeviceHwInfo:
      title: ocsfv1.6.0httpactivityDeviceHwInfo
      type: object
      description: >-
        The Device Hardware Information object contains details and
        specifications of the physical components that make up a device. This
        information provides an overview of the hardware capabilities,
        configuration, and characteristics of the device.
      properties:
        bios_date:
          type: string
          nullable: true
          description: 'The BIOS date. For example: <code>03/31/16</code>.'
        bios_manufacturer:
          type: string
          nullable: true
          description: 'The BIOS manufacturer. For example: <code>LENOVO</code>.'
        bios_uid:
          type: string
          nullable: true
          description: The BIOS UUID.
        bios_ver:
          type: string
          nullable: true
          description: 'The BIOS version. For example: <code>LENOVO G5ETA2WW (2.62)</code>.'
        chassis:
          type: string
          nullable: true
          description: >-
            The chassis type describes the system enclosure or physical form
            factor. Such as the following examples for Windows <a
            target="_blank"
            href="https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure">Windows
            Chassis Types</a>
        cpu_architecture:
          type: string
          nullable: true
          description: >-
            The CPU architecture, normalized to the caption of the
            <code>cpu_architecture_id</code> value. In the case of
            <code>Other</code>, it is defined by the source.
        cpu_architecture_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityDeviceHwInfo_CpuArchitectureId
          nullable: true
          description: The normalized identifier of the CPU architecture.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        cpu_cores:
          type: integer
          nullable: true
          description: >-
            The number of processor cores in all installed processors. For
            Example: <code>42</code>.
        cpu_count:
          type: integer
          nullable: true
          description: >-
            The number of physical processors on a system. For example:
            <code>1</code>.
        cpu_speed:
          type: integer
          nullable: true
          description: 'The speed of the processor in Mhz. For Example: <code>4200</code>.'
        cpu_type:
          type: string
          nullable: true
          description: >-
            The processor type. For example: <code>x86 Family 6 Model 37
            Stepping 5</code>.
        desktop_display:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDisplay'
          nullable: true
          description: The desktop display affiliated with the event
        keyboard_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyboardInfo'
          nullable: true
          description: The keyboard detailed information.
        ram_size:
          type: integer
          nullable: true
          description: >-
            The total amount of installed RAM, in Megabytes. For example:
            <code>2048</code>.
        serial_number:
          type: string
          nullable: true
          description: The device manufacturer serial number.
        uuid:
          type: string
          nullable: true
          description: >-
            The device manufacturer assigned universally unique hardware
            identifier. For SMBIOS compatible devices such as those running
            Linux and Windows, it is the UUID member of the System Information
            structure in the SMBIOS information. For macOS devices, it is the
            Hardware UUID (also known as IOPlatformUUID in the I/O Registry).
        vendor_name:
          type: string
          nullable: true
          description: The device manufacturer.
    ocsfv1.6.0httpactivityDeviceHwInfo_CpuArchitectureId:
      title: ocsfv1.6.0httpactivityDeviceHwInfo_CpuArchitectureId
      type: integer
      description: >-
        DeviceHwInfoCpuArchitectureId is an enum, and the following values are
        allowed.

        0 - Unknown: The CPU architecture is unknown.

        1 - x86: CPU uses the x86 ISA. For bitness, refer to
        <code>cpu_bits</code>.

        2 - ARM: CPU uses the ARM ISA. For bitness, refer to
        <code>cpu_bits</code>.

        3 - V: CPU uses the RISC-V ISA. For bitness, refer to
        <code>cpu_bits</code>.

        99 - Other: The CPU architecture is not mapped. See the
        <code>cpu_architecture</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityDigitalSignature:
      title: ocsfv1.6.0httpactivityDigitalSignature
      type: object
      description: >-
        The Digital Signature object contains information about the
        cryptographic mechanism used to verify the authenticity, integrity, and
        origin of the file or application.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The digital signature algorithm used to create the signature,
            normalized to the caption of 'algorithm_id'. In the case of 'Other',
            it is defined by the event source.
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityDigitalSignature_AlgorithmId
          description: The identifier of the normalized digital signature algorithm.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the digital signature was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the digital signature was created.
        developer_uid:
          type: string
          nullable: true
          description: The developer ID on the certificate that signed the file.
        digest:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: >-
            The message digest attribute contains the fixed length message hash
            representation and the corresponding hashing algorithm information.
        state:
          type: string
          nullable: true
          description: >-
            The digital signature state defines the signature state, normalized
            to the caption of 'state_id'. In the case of 'Other', it is defined
            by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDigitalSignature_StateId'
          nullable: true
          description: The normalized identifier of the signature state.
      required:
        - algorithm_id
    ocsfv1.6.0httpactivityDigitalSignature_AlgorithmId:
      title: ocsfv1.6.0httpactivityDigitalSignature_AlgorithmId
      type: integer
      description: >-
        DigitalSignatureAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DSA: Digital Signature Algorithm (DSA).

        2 - RSA: Rivest-Shamir-Adleman (RSA) Algorithm.

        3 - ECDSA: Elliptic Curve Digital Signature Algorithm.

        4 - Authenticode: Microsoft Authenticode Digital Signature Algorithm.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityDigitalSignature_StateId:
      title: ocsfv1.6.0httpactivityDigitalSignature_StateId
      type: integer
      description: >-
        DigitalSignatureStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The state is unknown.

        1 - Valid: The digital signature is valid.

        2 - Expired: The digital signature is not valid due to expiration of
        certificate.

        3 - Revoked: The digital signature is invalid due to certificate
        revocation.

        4 - Suspended: The digital signature is invalid due to certificate
        suspension.

        5 - Pending: The digital signature state is pending.

        99 - Other: The state is not mapped. See the <code>state</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityDisplay:
      title: ocsfv1.6.0httpactivityDisplay
      type: object
      description: >-
        The Display object contains information about the physical or virtual
        display connected to a computer system.
      properties:
        color_depth:
          type: integer
          nullable: true
          description: The numeric color depth.
        physical_height:
          type: integer
          nullable: true
          description: The numeric physical height of display.
        physical_orientation:
          type: integer
          nullable: true
          description: The numeric physical orientation of display.
        physical_width:
          type: integer
          nullable: true
          description: The numeric physical width of display.
        scale_factor:
          type: integer
          nullable: true
          description: The numeric scale factor of display.
    ocsfv1.6.0httpactivityDnsAnswer:
      title: ocsfv1.6.0httpactivityDnsAnswer
      type: object
      description: >-
        The DNS Answer object represents a specific response provided by the
        Domain Name System (DNS) when querying for information about a domain or
        performing a DNS operation. It encapsulates the relevant details and
        data returned by the DNS server in response to a query.
      properties:
        class:
          type: string
          nullable: true
          description: >-
            The class of DNS data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>IN</code>.
        flag_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityDnsAnswer_FlagIds'
          nullable: true
          description: The list of DNS answer header flag IDs.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The list of DNS answer header flags.
        packet_uid:
          type: integer
          nullable: true
          description: >-
            The DNS packet identifier assigned by the program that generated the
            query. The identifier is copied to the response.
        rdata:
          type: string
          description: >-
            The data describing the DNS resource. The meaning of this data
            depends on the type and class of the resource record.
        ttl:
          type: integer
          nullable: true
          description: >-
            The time interval that the resource record may be cached. Zero value
            means that the resource record can only be used for the transaction
            in progress, and should not be cached.
        type:
          type: string
          nullable: true
          description: >-
            The type of data contained in this resource record. See <a
            target="_blank"
            href="https://www.rfc-editor.org/rfc/rfc1035.txt">RFC1035</a>. For
            example: <code>CNAME</code>.
      required:
        - rdata
    ocsfv1.6.0httpactivityDnsAnswer_FlagIds:
      title: ocsfv1.6.0httpactivityDnsAnswer_FlagIds
      type: integer
      description: >-
        DnsAnswerFlagIds is an enum, and the following values are allowed.

        0 - Unknown: The flag is unknown.

        1 - AuthoritativeAnswer

        2 - TruncatedResponse

        3 - RecursionDesired

        4 - RecursionAvailable

        5 - AuthenticData

        6 - CheckingDisabled

        99 - Other: The flag is not mapped. See the <code>flags</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityDomainContact:
      title: ocsfv1.6.0httpactivityDomainContact
      type: object
      description: >-
        The contact information related to a domain registration, e.g.,
        registrant, administrator, abuse, billing, or technical contact.
      properties:
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLocation'
          nullable: true
          description: >-
            Location details for the contract such as the city, state/province,
            country, etc.
        name:
          type: string
          nullable: true
          description: The individual or organization name for the contact.
        phone_number:
          type: string
          nullable: true
          description: The number associated with the phone.
        type:
          type: string
          nullable: true
          description: >-
            The Domain Contact type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDomainContact_TypeId'
          description: The normalized domain contact type ID.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the contact information, typically provided
            in WHOIS information.
      required:
        - type_id
    ocsfv1.6.0httpactivityDomainContact_TypeId:
      title: ocsfv1.6.0httpactivityDomainContact_TypeId
      type: integer
      description: >-
        DomainContactTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Registrant: The contact information provided is for the domain
        registrant.

        2 - Administrative: The contact information provided is for the domain
        administrator.

        3 - Technical: The contact information provided is for the domain
        technical lead.

        4 - Billing: The contact information provided is for the domain billing
        lead.

        5 - Abuse: The contact information provided is for the domain abuse
        contact.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityEmail:
      title: ocsfv1.6.0httpactivityEmail
      type: object
      description: >-
        The Email object describes the email metadata such as sender,
        recipients, and direction, and can include embedded URLs and files.
      properties:
        bcc:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The BCC recipients of the email. Similar to cc field but for BCC
            recipients.
        cc:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Cc values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>.
        cc_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Cc Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        delivered_to:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            field. For example <code>example.user@usersdomain.com</code>
        delivered_to_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable <strong>Delivered-To</strong> email header
            values. For example <code>example.user@usersdomain.com</code>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          nullable: true
          description: The files embedded or attached to the email.
        from:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header From value, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>.
        from_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header From values. This array should
            contain the value in <code>from</code>. For example
            <code>example.user@usersdomain.com</code>.
        from_mailbox:
          type: string
          nullable: true
          description: >-
            The human-readable email header From Mailbox value. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        from_mailboxes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The human-readable email header From Mailbox values. This array
            should contain the value in <code>from_mailbox</code>. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        is_externally_viewable:
          type: boolean
          nullable: true
          description: >-
            True if the email is viewable externally (presumably by external
            users).
        is_read:
          type: boolean
          nullable: true
          description: The indication of whether the email has been read.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        message_uid:
          type: string
          nullable: true
          description: The email header Message-ID value, as defined by RFC 5322.
        raw_header:
          type: string
          nullable: true
          description: The email authentication header.
        reply_to:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Reply-To value, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header Reply-To values, as defined by RFC
            5322. For example <code>example.user@usersdomain.com</code>
        reply_to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header Reply To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        return_path:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The address found in the 'Return-Path' header, which indicates where
            bounce messages (non-delivery reports) should be sent. This address
            is often set by the sending system and may differ from the 'From' or
            'Sender' addresses. For example,
            <code>mailer-daemon@senderserver.com</code>.
        sender:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine readable email address of the system or server that
            actually transmitted the email message, extracted from the email
            headers per RFC 5322. This differs from the <code>from</code> field,
            which shows the message author. The sender field is most commonly
            used when multiple addresses appear in the <code> from_list </code>
            field, or when the transmitting system is different from the message
            author (such as when sending on behalf of someone else).
        sender_mailbox:
          type: string
          nullable: true
          description: >-
            The human readable email address of the system or server that
            actually transmitted the email message, extracted from the email
            headers per RFC 5322. This differs from the
            <code>from_mailbox</code> field, which shows the message author. The
            sender mailbox field is most commonly used when multiple addresses
            appear in the <code> from_mailboxes </code> field, or when the
            transmitting system is different from the message author (such as
            when sending on behalf of someone else).
        sender_mailbox_uid:
          type: string
          nullable: true
          description: >-
            Unique ID of the sender mailbox. This is distinct from the sender's
            email address.
        size:
          type: integer
          nullable: true
          description: The size in bytes of the email, including attachments.
        smtp_from:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The value of the SMTP MAIL FROM command.
        smtp_to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The value of the SMTP envelope RCPT TO command.
        subject:
          type: string
          nullable: true
          description: The email header Subject value, as defined by RFC 5322.
        time_sent:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time at which the email was sent.
        time_sent_dt:
          type: string
          format: date-time
          nullable: true
          description: The time at which the email was sent.
        to:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: >-
            The machine-readable email header To values, as defined by RFC 5322.
            For example <code>example.user@usersdomain.com</code>
        to_mailboxes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The human-readable email header To Mailbox values. For example
            <code>'Example User &lt;example.user@usersdomain.com&gt;'</code>.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the email thread.
        urls:
          type: array
          items:
            type: string
          nullable: true
          description: The URLs embedded in the email.
        x_originating_ip:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: >-
            The X-Originating-IP header identifying the emails originating IP
            address(es).
    ocsfv1.6.0httpactivityEmailAuth:
      title: ocsfv1.6.0httpactivityEmailAuth
      type: object
      description: >-
        The Email Authentication object describes the Sender Policy Framework
        (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message
        Authentication, Reporting and Conformance (DMARC) attributes of an
        email.
      properties:
        dkim:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) status of the email.
        dkim_domain:
          type: string
          nullable: true
          description: The DomainKeys Identified Mail (DKIM) signing domain of the email.
        dkim_signature:
          type: string
          nullable: true
          description: >-
            The DomainKeys Identified Mail (DKIM) signature used by the
            sending/receiving system.
        dmarc:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) status of the email.
        dmarc_override:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) override action.
        dmarc_policy:
          type: string
          nullable: true
          description: >-
            The Domain-based Message Authentication, Reporting and Conformance
            (DMARC) policy status.
        spf:
          type: string
          nullable: true
          description: The Sender Policy Framework (SPF) status of the email.
    ocsfv1.6.0httpactivityEncryptionDetails:
      title: ocsfv1.6.0httpactivityEncryptionDetails
      type: object
      description: Details about the encryption methodology utilized.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The encryption algorithm used, normalized to the caption of
            'algorithm_id
        algorithm_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityEncryptionDetails_AlgorithmId
          nullable: true
          description: The encryption algorithm used.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key used.
        key_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the key used for encryption. For example,
            AWS KMS Key ARN.
        type:
          type: string
          nullable: true
          description: The type of the encryption used.
    ocsfv1.6.0httpactivityEncryptionDetails_AlgorithmId:
      title: ocsfv1.6.0httpactivityEncryptionDetails_AlgorithmId
      type: integer
      description: >-
        EncryptionDetailsAlgorithmId is an enum, and the following values are
        allowed.

        0 - Unknown: The algorithm is unknown.

        1 - DES: Data Encryption Standard Algorithm

        2 - TripleDES: Triple Data Encryption Standard Algorithm

        3 - AES: Advanced Encryption Standard Algorithm.

        4 - RSA: Rivest-Shamir-Adleman Algorithm

        5 - ECC: Elliptic Curve Cryptography Algorithm

        6 - SM2: ShangMi Cryptographic Algorithm

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityEndpointConnection:
      title: ocsfv1.6.0httpactivityEndpointConnection
      type: object
      description: >-
        The Endpoint Connection object contains information detailing a
        connection attempt to an endpoint.
      properties:
        code:
          type: integer
          nullable: true
          description: >-
            A numerical response status code providing details about the
            connection.
        network_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkEndpoint'
          nullable: true
          description: Provides characteristics of the network endpoint.
    ocsfv1.6.0httpactivityEnrichment:
      title: ocsfv1.6.0httpactivityEnrichment
      type: object
      description: >-
        The Enrichment object provides inline enrichment data for specific
        attributes of interest within an event. It serves as a mechanism to
        enhance or supplement the information associated with the event by
        adding additional relevant details or context.
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the enrichment data was generated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the enrichment data was generated.
        data:
          description: >-
            The enrichment data associated with the attribute and value. The
            meaning of this data depends on the type the enrichment record.
        desc:
          type: string
          nullable: true
          description: A long description of the enrichment data.
        name:
          type: string
          description: The name of the attribute to which the enriched data pertains.
        provider:
          type: string
          nullable: true
          description: The enrichment data provider name.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityReputation'
          nullable: true
          description: The reputation of the enrichment data.
        short_desc:
          type: string
          nullable: true
          description: A short description of the enrichment data.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: The URL of the source of the enrichment data.
        type:
          type: string
          nullable: true
          description: 'The enrichment type. For example: <code>location</code>.'
        value:
          type: string
          description: The value of the attribute to which the enriched data pertains.
      required:
        - data
        - name
        - value
    ocsfv1.6.0httpactivityEnvironmentVariable:
      title: ocsfv1.6.0httpactivityEnvironmentVariable
      type: object
      description: An environment variable.
      properties:
        name:
          type: string
          description: The name of the environment variable.
        value:
          type: string
          description: The value of the environment variable.
      required:
        - name
        - value
    ocsfv1.6.0httpactivityEpss:
      title: ocsfv1.6.0httpactivityEpss
      type: object
      description: >-
        The Exploit Prediction Scoring System (EPSS) object describes the
        estimated probability a vulnerability will be exploited. EPSS is a
        community-driven effort to combine descriptive information about
        vulnerabilities (CVEs) with evidence of actual exploitation in-the-wild.
        (<a target="_blank" href="https://www.first.org/epss/">EPSS</a>).
      properties:
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the EPSS score was calculated.
        percentile:
          type: number
          format: double
          nullable: true
          description: >-
            The EPSS score's percentile representing relative importance and
            ranking of the score in the larger EPSS dataset.
        score:
          type: string
          description: >-
            The EPSS score representing the probability [0-1] of exploitation in
            the wild in the next 30 days (following score publication).
        version:
          type: string
          nullable: true
          description: The version of the EPSS model used to calculate the score.
      required:
        - score
    ocsfv1.6.0httpactivityExtension:
      title: ocsfv1.6.0httpactivityExtension
      type: object
      description: >-
        The OCSF Schema Extension object provides detailed information about the
        schema extension used to construct the event. The schema extensions are
        registered in the <a target="_blank"
        href="https://github.com/ocsf/ocsf-schema/blob/main/extensions.md">extensions.md</a>
        file.
      properties:
        name:
          type: string
          description: 'The schema extension name. For example: <code>dev</code>.'
        uid:
          type: string
          description: >-
            The schema extension unique identifier. For example:
            <code>999</code>.
        version:
          type: string
          description: >-
            The schema extension version. For example:
            <code>1.0.0-alpha.2</code>.
      required:
        - name
        - uid
        - version
    ocsfv1.6.0httpactivityFeature:
      title: ocsfv1.6.0httpactivityFeature
      type: object
      description: >-
        The Feature object provides information about the software product
        feature that generated a specific event. It encompasses details related
        to the capabilities, components, user interface (UI) design, and
        performance upgrades associated with the feature.
      properties:
        name:
          type: string
          nullable: true
          description: The name of the feature.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the feature.
        version:
          type: string
          nullable: true
          description: The version of the feature.
    ocsfv1.6.0httpactivityFile:
      title: ocsfv1.6.0httpactivityFile
      type: object
      description: >-
        The File object represents the metadata associated with a file stored in
        a computer system. It encompasses information about the file itself,
        including its attributes, properties, and organizational details.
      properties:
        accessed_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the file was last accessed.
        accessed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last accessed.
        accessor:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: The name of the user who last accessed the object.
        accessor_app:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: >-
            The app which mediated access to the file. This could be separate
            from the source app, for example a case where a user exports a
            report from a web app. The source app would be their browser and the
            accessor app the web app.
        attributes:
          type: integer
          nullable: true
          description: The bitmask value that represents the file attributes.
        company_name:
          type: string
          nullable: true
          description: >-
            The name of the company that published the file. For example:
            <code>Microsoft Corporation</code>.
        confidentiality:
          type: string
          nullable: true
          description: >-
            The file content confidentiality, normalized to the
            confidentiality_id value. In the case of 'Other', it is defined by
            the event source.
        confidentiality_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile_ConfidentialityId'
          nullable: true
          description: >-
            The normalized identifier of the file content confidentiality
            indicator.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the file was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was created.
        creator:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: The user that created the file.
        desc:
          type: string
          nullable: true
          description: >-
            The description of the file, as returned by file system. For
            example: the description as returned by the Unix file command or the
            Windows file type.
        drive_type:
          type: string
          nullable: true
          description: >-
            The drive type, normalized to the caption of the
            <code>drive_type_id</code> value. In the case of <code>Other</code>,
            it is defined by the source.
        drive_type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile_DriveTypeId'
          nullable: true
          description: Identifies the type of a disk drive, i.e. fixed, removable, etc.
        encryption_details:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEncryptionDetails'
          nullable: true
          description: >-
            The encryption details of the file. Should be populated if the file
            is encrypted.
        ext:
          type: string
          nullable: true
          description: >-
            The extension of the file, excluding the leading dot. For example:
            <code>exe</code> from <code>svchost.exe</code>, or <code>gz</code>
            from <code>export.tar.gz</code>.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: An array of hash attributes.
        internal_name:
          type: string
          nullable: true
          description: >-
            The name of the file as identified within the file itself. This
            contrasts with the name by which the file is known on disk. Where
            available, the internal name is widely used by security
            practitioners and detection content because the on-disk file name is
            not reliable. On the Windows OS, most PE files contain a <a
            href="https://learn.microsoft.com/en-us/windows/win32/menurc/versioninfo-resource">VERSIONINFO</a>
            resource from which the internal name can be obtained. On macOS,
            binaries can optionally embed a copy of the application's Info.plist
            file which in turn contains the name of the executable.
        is_deleted:
          type: boolean
          nullable: true
          description: Indicates if the file was deleted from the filesystem.
        is_encrypted:
          type: boolean
          nullable: true
          description: Indicates if the file is encrypted.
        is_public:
          type: boolean
          nullable: true
          description: >-
            Indicates if the file is publicly accessible. For example in an
            object's public access in AWS S3
        is_readonly:
          type: boolean
          nullable: true
          description: Indicates that the file cannot be modified.
        is_system:
          type: boolean
          nullable: true
          description: >-
            The indication of whether the object is part of the operating
            system.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Labels associated with the object, such as security or sensitivity
            labels created by a scanning app.
        mime_type:
          type: string
          nullable: true
          description: >-
            The Multipurpose Internet Mail Extensions (MIME) type of the file,
            if applicable.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the file was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the file was last modified.
        modifier:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: The user that last modified the file.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFileName'
          description: 'The name of the file. For example: <code>svchost.exe</code>'
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: The user that owns the file/object.
        parent_folder:
          type: string
          nullable: true
          description: >-
            The parent folder in which the file resides. For example:
            <code>c:\windows\system32</code>
        path:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFilePath'
          nullable: true
          description: >-
            The full path to the file. For example:
            <code>c:\windows\system32\svchost.exe</code>.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: The product that created or installed the file.
        security_descriptor:
          type: string
          nullable: true
          description: The object security descriptor.
        signature:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDigitalSignature'
          nullable: true
          description: The digital signature of the file.
        size:
          type: integer
          nullable: true
          description: The size of data, in bytes.
        storage_class:
          type: string
          nullable: true
          description: >-
            The storage class of the file. For example in AWS S3:
            <code>STANDARD, STANDARD_IA, GLACIER</code>.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            file.
        type:
          type: string
          nullable: true
          description: The file type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile_TypeId'
          description: >-
            The file type ID. Note the distinction between a <code>Regular
            File</code> and an <code>Executable File</code>. If the distinction
            is not known, or not indicated by the log, use <code>Regular
            File</code>. In this case, it should not be assumed that a Regular
            File is not executable.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the file as defined by the storage system,
            such the file system file ID.
        uri:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The file URI, such as those reporting by static analysis tools.
            E.g.,
            <code>file:///C:/dev/sarif/sarif-tutorials/samples/Introduction/simple-example.js</code>
        url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUrl'
          nullable: true
          description: The URL of the file, when applicable.
        version:
          type: string
          nullable: true
          description: 'The file version. For example: <code>8.0.7601.17514</code>.'
        volume:
          type: string
          nullable: true
          description: The volume on the storage device where the file is located.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs where each
            pair represents a file or folder extended attribute.</p>For example:
            Windows alternate data stream attributes (ADS stream name, ADS size,
            etc.), user-defined or application-defined attributes, ACL, owner,
            primary group, etc. Examples from DCS:
            </p><ul><li><strong>ads_name</strong></li><li><strong>ads_size</strong></li><li><strong>dacl</strong></li><li><strong>owner</strong></li><li><strong>primary_group</strong></li><li><strong>link_name</strong>
            - name of the link associated to the
            file.</li><li><strong>hard_link_count</strong> - the number of links
            that are associated to the file.</li></ul>
      required:
        - name
        - type_id
    ocsfv1.6.0httpactivityFile_ConfidentialityId:
      title: ocsfv1.6.0httpactivityFile_ConfidentialityId
      type: integer
      description: >-
        FileConfidentialityId is an enum, and the following values are allowed.

        0 - Unknown: The confidentiality is unknown.

        1 - NotConfidential

        2 - Confidential

        3 - Secret

        4 - TopSecret

        5 - Private

        6 - Restricted

        99 - Other: The confidentiality is not mapped. See the
        <code>confidentiality</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityFile_DriveTypeId:
      title: ocsfv1.6.0httpactivityFile_DriveTypeId
      type: integer
      description: >-
        FileDriveTypeId is an enum, and the following values are allowed.

        0 - Unknown: The drive type is unknown.

        1 - Removable: The drive has removable media; for example, a floppy
        drive, thumb drive, or flash card reader.

        2 - Fixed: The drive has fixed media; for example, a hard disk drive or
        flash drive.

        3 - Remote: The drive is a remote (network) drive.

        4 - ROM: The drive is a CD-ROM drive.

        5 - RAMDisk: The drive is a RAM disk.

        99 - Other: The drive type is not mapped. See the
        <code>drive_type</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityFile_TypeId:
      title: ocsfv1.6.0httpactivityFile_TypeId
      type: integer
      description: >-
        FileTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - RegularFile

        2 - Folder

        3 - CharacterDevice

        4 - BlockDevice

        5 - LocalSocket

        6 - NamedPipe

        7 - SymbolicLink

        8 - ExecutableFile

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityFingerprint:
      title: ocsfv1.6.0httpactivityFingerprint
      type: object
      description: >-
        The Fingerprint object provides detailed information about a digital
        fingerprint, which is a compact representation of data used to identify
        a longer piece of information, such as a public key or file content. It
        contains the algorithm and value of the fingerprint, enabling efficient
        and reliable identification of the associated data.
      properties:
        algorithm:
          type: string
          nullable: true
          description: >-
            The hash algorithm used to create the digital fingerprint,
            normalized to the caption of <code>algorithm_id</code>. In the case
            of <code>Other</code>, it is defined by the event source.
        algorithm_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint_AlgorithmId'
          description: >-
            The identifier of the normalized hash algorithm, which was used to
            create the digital fingerprint.
        value:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHash'
          description: The digital fingerprint value.
      required:
        - algorithm_id
        - value
    ocsfv1.6.0httpactivityFingerprint_AlgorithmId:
      title: ocsfv1.6.0httpactivityFingerprint_AlgorithmId
      type: integer
      description: >-
        FingerprintAlgorithmId is an enum, and the following values are allowed.

        0 - Unknown: The algorithm is unknown.

        1 - MD5: MD5 message-digest algorithm producing a 128-bit (16-byte) hash
        value.

        2 - 1: Secure Hash Algorithm 1 producing a 160-bit (20-byte) hash value.

        3 - 256: Secure Hash Algorithm 2 producing a 256-bit (32-byte) hash
        value.

        4 - 512: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value.

        5 - CTPH: The ssdeep generated fuzzy checksum. Also known as Context
        Triggered Piecewise Hash (CTPH).

        6 - TLSH: The TLSH fuzzy hashing algorithm.

        7 - quickXorHash: Microsoft simple non-cryptographic hash algorithm that
        works by XORing the bytes in a circular-shifting fashion.

        8 - 224: Secure Hash Algorithm 2 producing a 224-bit (28-byte) hash
        value.

        9 - 384: Secure Hash Algorithm 2 producing a 384-bit (48-byte) hash
        value.

        10 - 512_224: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value truncated to a 224-bit (28-byte) hash value.

        11 - 512_256: Secure Hash Algorithm 2 producing a 512-bit (64-byte) hash
        value truncated to a 256-bit (32-byte) hash value.

        12 - 224: Secure Hash Algorithm 3 producing a 224-bit (28-byte) hash
        value.

        13 - 256: Secure Hash Algorithm 3 producing a 256-bit (32-byte) hash
        value.

        14 - 384: Secure Hash Algorithm 3 producing a 384-bit (48-byte) hash
        value.

        15 - 512: Secure Hash Algorithm 3 producing a 512-bit (64-byte) hash
        value.

        16 - bit: xxHash H3 producing a 64-bit hash value.

        17 - bit: xxHash H3 producing a 128-bit hash value.

        99 - Other: The algorithm is not mapped. See the <code>algorithm</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityFirewallRule:
      title: ocsfv1.6.0httpactivityFirewallRule
      type: object
      description: >-
        The Firewall Rule object represents a specific rule within a firewall
        policy or event. It contains information about a rule's configuration,
        properties, and associated actions that define how network traffic is
        handled by the firewall.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        condition:
          type: string
          nullable: true
          description: 'The rule trigger condition for the rule. For example: SQL_INJECTION.'
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        duration:
          type: integer
          nullable: true
          description: >-
            The rule response time duration, usually used for challenge
            completion time.
        match_details:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The data in a request that rule matched. For example:
            '["10","and","1"]'.
        match_location:
          type: string
          nullable: true
          description: >-
            The location of the matched data in the source which resulted in the
            triggered firewall rule. For example: HEADER.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        rate_limit:
          type: integer
          nullable: true
          description: The rate limit for a rate-based rule.
        sensitivity:
          type: string
          nullable: true
          description: >-
            The sensitivity of the firewall rule in the matched event. For
            example: HIGH.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.6.0httpactivityGroup:
      title: ocsfv1.6.0httpactivityGroup
      type: object
      description: >-
        The Group object represents a collection or association of entities,
        such as users, policies, or devices. It serves as a logical grouping
        mechanism to organize and manage entities with similar characteristics
        or permissions within a system or organization, including but not
        limited to purposes of access control.
      properties:
        desc:
          type: string
          nullable: true
          description: The group description.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the group is defined. For example: the LDAP or
            Active Directory domain.
        name:
          type: string
          nullable: true
          description: The group name.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The group privileges.
        type:
          type: string
          nullable: true
          description: The type of the group or account.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the group. For example, for Windows events
            this is the security identifier (SID) of the group.
    ocsfv1.6.0httpactivityHttpCookie:
      title: ocsfv1.6.0httpactivityHttpCookie
      type: object
      description: >-
        The HTTP Cookie object, also known as a web cookie or browser cookie,
        contains details and values pertaining to a small piece of data that a
        server sends to a user's web browser. This data is then stored by the
        browser and sent back to the server with subsequent requests, allowing
        the server to remember and track certain information about the user's
        browsing session or preferences.
      properties:
        domain:
          type: string
          nullable: true
          description: The domain name for the server from which the http_cookie is served.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The expiration time of the HTTP cookie.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The expiration time of the HTTP cookie.
        http_only:
          type: boolean
          nullable: true
          description: A cookie attribute to make it inaccessible via JavaScript
        is_http_only:
          type: boolean
          nullable: true
          description: >-
            This attribute prevents the cookie from being accessed via
            JavaScript.
        is_secure:
          type: boolean
          nullable: true
          description: >-
            The cookie attribute indicates that cookies are sent to the server
            only when the request is encrypted using the HTTPS protocol.
        name:
          type: string
          description: The HTTP cookie name.
        path:
          type: string
          nullable: true
          description: The path of the HTTP cookie.
        samesite:
          type: string
          nullable: true
          description: >-
            The cookie attribute that lets servers specify whether/when cookies
            are sent with cross-site requests. Values are: Strict, Lax or None
        secure:
          type: boolean
          nullable: true
          description: >-
            The cookie attribute to only send cookies to the server with an
            encrypted request over the HTTPS protocol.
        value:
          type: string
          description: The HTTP cookie value.
      required:
        - name
        - value
    ocsfv1.6.0httpactivityHttpHeader:
      title: ocsfv1.6.0httpactivityHttpHeader
      type: object
      description: >-
        The HTTP Header object represents the headers sent in an HTTP request or
        response. HTTP headers are key-value pairs that convey additional
        information about the HTTP message, including details about the content,
        caching, authentication, encoding, and other aspects of the
        communication.
      properties:
        name:
          type: string
          description: The name of the HTTP header.
        value:
          type: string
          description: The value of the HTTP header.
      required:
        - name
        - value
    ocsfv1.6.0httpactivityHttpRequest:
      title: ocsfv1.6.0httpactivityHttpRequest
      type: object
      description: >-
        The HTTP Request object represents the attributes of a request made to a
        web server. It encapsulates the details and metadata associated with an
        HTTP request, including the request method, headers, URL, query
        parameters, body content, and other relevant information.
      properties:
        args:
          type: string
          nullable: true
          description: The arguments sent along with the HTTP request.
        body_length:
          type: integer
          nullable: true
          description: >-
            The actual length of the HTTP request body, in number of bytes,
            independent of a potentially existing Content-Length header.
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        http_method:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpRequest_HttpMethod'
          nullable: true
          description: >-
            The <a target='_blank'
            href='https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods'>HTTP
            request method</a> indicates the desired action to be performed for
            a given resource.
        length:
          type: integer
          nullable: true
          description: The length of the entire HTTP request, in number of bytes.
        referrer:
          type: string
          nullable: true
          description: >-
            The request header that identifies the address of the previous web
            page, which is linked to the current web page or resource being
            requested.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the http request.
        url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUrl'
          nullable: true
          description: The URL object that pertains to the request.
        user_agent:
          type: string
          nullable: true
          description: >-
            The request header that identifies the operating system and web
            browser.
        user_agent_name:
          type: string
          nullable: true
          description: >-
            Concise version of the user agent, e.g. Chrome or Firefox instead of
            the full user-agent string.
        version:
          type: string
          nullable: true
          description: The Hypertext Transfer Protocol (HTTP) version.
        x_forwarded_for:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: >-
            The X-Forwarded-For header identifying the originating IP
            address(es) of a client connecting to a web server through an HTTP
            proxy or a load balancer.
    ocsfv1.6.0httpactivityHttpRequest_HttpMethod:
      title: ocsfv1.6.0httpactivityHttpRequest_HttpMethod
      type: string
      description: >-
        HttpRequestHttpMethod is an enum, and the following values are allowed.

        CONNECT - Connect: The CONNECT method establishes a tunnel to the server
        identified by the target resource.

        DELETE - Delete: The DELETE method deletes the specified resource.

        GET - Get: The GET method requests a representation of the specified
        resource. Requests using GET should only retrieve data.

        HEAD - Head: The HEAD method asks for a response identical to a GET
        request, but without the response body.

        OPTIONS - Options: The OPTIONS method describes the communication
        options for the target resource.

        PATCH - Patch: The PATCH method applies partial modifications to a
        resource.

        POST - Post: The POST method submits an entity to the specified
        resource, often causing a change in state or side effects on the server.

        PUT - Put: The PUT method replaces all current representations of the
        target resource with the request payload.

        TRACE - Trace: The TRACE method performs a message loop-back test along
        the path to the target resource.
    ocsfv1.6.0httpactivityHttpResponse:
      title: ocsfv1.6.0httpactivityHttpResponse
      type: object
      description: >-
        The HTTP Response object contains detailed information about the
        response sent from a web server to the requester. It encompasses
        attributes and metadata that describe the response status, headers, body
        content, and other relevant information.
      properties:
        body_length:
          type: integer
          nullable: true
          description: >-
            The actual length of the HTTP response body, in number of bytes,
            independent of a potentially existing Content-Length header.
        code:
          type: integer
          description: >-
            The Hypertext Transfer Protocol (HTTP) status code returned from the
            web server to the client. For example, 200.
        content_type:
          type: string
          nullable: true
          description: >-
            The request header that identifies the original <a target="_blank"
            href="https://www.iana.org/assignments/media-types/media-types.xhtml">media
            type </a> of the resource (prior to any content encoding applied for
            sending).
        http_headers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityHttpHeader'
          nullable: true
          description: Additional HTTP headers of an HTTP request or response.
        latency:
          type: integer
          nullable: true
          description: The HTTP response latency measured in milliseconds.
        length:
          type: integer
          nullable: true
          description: The length of the entire HTTP response, in number of bytes.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
        status:
          type: string
          nullable: true
          description: >-
            The response status. For example: A successful HTTP status of 'OK'
            which corresponds to a code of 200.
      required:
        - code
    ocsfv1.6.0httpactivityIdp:
      title: ocsfv1.6.0httpactivityIdp
      type: object
      description: >-
        The Identity Provider object contains detailed information about a
        provider responsible for creating, maintaining, and managing identity
        information while offering authentication services to applications. An
        Identity Provider (IdP) serves as a trusted authority that verifies the
        identity of users and issues authentication tokens or assertions to
        enable secure access to applications or services.
      properties:
        auth_factors:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAuthFactor'
          nullable: true
          description: >-
            The Authentication Factors object describes the different types of
            Multi-Factor Authentication (MFA) methods and/or devices supported
            by the Identity Provider.
        domain:
          type: string
          nullable: true
          description: The primary domain associated with the Identity Provider.
        fingerprint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: >-
            The fingerprint of the X.509 certificate used by the Identity
            Provider.
        has_mfa:
          type: boolean
          nullable: true
          description: The Identity Provider enforces Multi Factor Authentication (MFA).
        issuer:
          type: string
          nullable: true
          description: >-
            The unique identifier (often a URL) used by the Identity Provider as
            its issuer.
        name:
          type: string
          nullable: true
          description: The name of the Identity Provider.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol of the Identity Provider. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        scim:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityScim'
          nullable: true
          description: >-
            The System for Cross-domain Identity Management (SCIM) resource
            object provides a structured set of attributes related to SCIM
            protocols used for identity provisioning and management across
            cloud-based platforms. It standardizes user and group provisioning
            details, enabling identity synchronization and lifecycle management
            with compatible Identity Providers (IdPs) and applications. SCIM is
            defined in <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc7643'>RFC-7634</a>
        sso:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySso'
          nullable: true
          description: >-
            The Single Sign-On (SSO) object provides a structure for normalizing
            SSO attributes, configuration, and/or settings from Identity
            Providers.
        state:
          type: string
          nullable: true
          description: >-
            The configuration state of the Identity Provider, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIdp_StateId'
          nullable: true
          description: >-
            The normalized state ID of the Identity Provider to reflect its
            configuration or activation status.
        tenant_uid:
          type: string
          nullable: true
          description: The tenant ID associated with the Identity Provider.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the Identity Provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The URL for accessing the configuration or metadata of the Identity
            Provider.
    ocsfv1.6.0httpactivityIdp_StateId:
      title: ocsfv1.6.0httpactivityIdp_StateId
      type: integer
      description: >-
        IdpStateId is an enum, and the following values are allowed.

        0 - Unknown: The configuration state of the Identity Provider is
        unknown.

        1 - Active: The Identity Provider is in an Active state, or otherwise
        enabled.

        2 - Suspended: The Identity Provider is in a Suspended state.

        3 - Deprecated: The Identity Provider is in a Deprecated state, or is
        otherwise disabled.

        4 - Deleted: The Identity Provider is in a Deleted state.

        99 - Other: The configuration state of the Identity Provider is not
        mapped. See the <code>state</code> attribute, which contains a data
        source specific value.
    ocsfv1.6.0httpactivityImage:
      title: ocsfv1.6.0httpactivityImage
      type: object
      description: >-
        The Image object provides a description of a specific Virtual Machine
        (VM) or Container image.
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated to the image.
        name:
          type: string
          nullable: true
          description: 'The image name. For example: <code>elixir</code>.'
        path:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFilePath'
          nullable: true
          description: The full path to the image file.
        tag:
          type: string
          nullable: true
          description: 'The image tag. For example: <code>1.11-alpine</code>.'
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            image.
        uid:
          type: string
          description: 'The unique image ID. For example: <code>77af4d6b9913</code>.'
      required:
        - uid
    ocsfv1.6.0httpactivityJa4Fingerprint:
      title: ocsfv1.6.0httpactivityJa4Fingerprint
      type: object
      description: >-
        The JA4+ fingerprint object provides detailed fingerprint information
        about various aspects of network traffic which is both machine and human
        readable.
      properties:
        section_a:
          type: string
          nullable: true
          description: The 'a' section of the JA4 fingerprint.
        section_b:
          type: string
          nullable: true
          description: The 'b' section of the JA4 fingerprint.
        section_c:
          type: string
          nullable: true
          description: The 'c' section of the JA4 fingerprint.
        section_d:
          type: string
          nullable: true
          description: The 'd' section of the JA4 fingerprint.
        type:
          type: string
          nullable: true
          description: >-
            The JA4+ fingerprint type as defined by <a
            href="https://blog.foxio.io/ja4+-network-fingerprinting
            target=">FoxIO</a>, normalized to the caption of 'type_id'. In the
            case of 'Other', it is defined by the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityJa4Fingerprint_TypeId'
          description: The identifier of the JA4+ fingerprint type.
        value:
          type: string
          description: The JA4+ fingerprint value.
      required:
        - type_id
        - value
    ocsfv1.6.0httpactivityJa4Fingerprint_TypeId:
      title: ocsfv1.6.0httpactivityJa4Fingerprint_TypeId
      type: integer
      description: >-
        Ja4FingerprintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - JA4: TLS Client Fingerprint.

        2 - JA4Server: TLS Server Response/Session Fingerprint.

        3 - JA4HTTP: HTTP Client Fingerprint.

        4 - JA4Latency: Latency Measurement/Light Distance Fingerprint.

        5 - JA4X509: X509 TLS Certificate Fingerprint.

        6 - JA4SSH: SSH Traffic Fingerprint.

        7 - JA4TCP: Passive TCP Client Fingerprint.

        8 - JA4TCPServer: Passive TCP Server Fingerprint.

        9 - JA4TCPScan: Active TCP Server Fingerprint.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityKbArticle:
      title: ocsfv1.6.0httpactivityKbArticle
      type: object
      description: >-
        The KB Article object contains metadata that describes the patch or
        update.
      properties:
        avg_timespan:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimespan'
          nullable: true
          description: The average time to patch.
        bulletin:
          type: string
          nullable: true
          description: The kb article bulletin identifier.
        classification:
          type: string
          nullable: true
          description: The vendors classification of the kb article.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The date the kb article was released by the vendor.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The date the kb article was released by the vendor.
        install_state:
          type: string
          nullable: true
          description: The install state of the kb article.
        install_state_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityKbArticle_InstallStateId'
          nullable: true
          description: The normalized install state ID of the kb article.
        is_superseded:
          type: boolean
          nullable: true
          description: The kb article has been replaced by another.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOs'
          nullable: true
          description: The operating system the kb article applies.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: The product details the kb article applies.
        severity:
          type: string
          nullable: true
          description: The severity of the kb article.
        size:
          type: integer
          nullable: true
          description: The size in bytes for the kb article.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: The kb article link from the source vendor.
        title:
          type: string
          nullable: true
          description: The title of the kb article.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the kb article.
    ocsfv1.6.0httpactivityKbArticle_InstallStateId:
      title: ocsfv1.6.0httpactivityKbArticle_InstallStateId
      type: integer
      description: >-
        KbArticleInstallStateId is an enum, and the following values are
        allowed.

        0 - Unknown: The normalized install state is unknown.

        1 - Installed: The item is installed.

        2 - NotInstalled: The item is not installed.

        3 - InstalledPendingReboot: The item is installed pending reboot
        operation.

        99 - Other: The install state is not mapped. See the
        <code>install_state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityKeyValueObject:
      title: ocsfv1.6.0httpactivityKeyValueObject
      type: object
      description: A generic object allowing to define a <code>{key:value}</code> pair.
      properties:
        name:
          type: string
          description: The name of the key.
        value:
          type: string
          nullable: true
          description: The value associated to the key.
        values:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Optional, the values associated to the key. You can populate this
            attribute, when you have multiple values for the same key.
      required:
        - name
    ocsfv1.6.0httpactivityKeyboardInfo:
      title: ocsfv1.6.0httpactivityKeyboardInfo
      type: object
      description: >-
        The Keyboard Information object contains details and attributes related
        to a computer or device keyboard. It encompasses information that
        describes the characteristics, capabilities, and configuration of the
        keyboard.
      properties:
        function_keys:
          type: integer
          nullable: true
          description: The number of function keys on client keyboard.
        ime:
          type: string
          nullable: true
          description: The Input Method Editor (IME) file name.
        keyboard_layout:
          type: string
          nullable: true
          description: The keyboard locale identifier name (e.g., en-US).
        keyboard_subtype:
          type: integer
          nullable: true
          description: The keyboard numeric code.
        keyboard_type:
          type: string
          nullable: true
          description: The keyboard type (e.g., xt, ico).
    ocsfv1.6.0httpactivityKillChainPhase:
      title: ocsfv1.6.0httpactivityKillChainPhase
      type: object
      description: >-
        The Kill Chain Phase object represents a single phase of a cyber attack,
        including the initial reconnaissance and planning stages up to the final
        objective of the attacker. It provides a detailed description of each
        phase and its associated activities within the broader context of a
        cyber attack. See <a target="_blank"
        href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html">Cyber
        Kill Chain®</a>.
      properties:
        phase:
          type: string
          nullable: true
          description: The cyber kill chain phase.
        phase_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityKillChainPhase_PhaseId'
          description: The cyber kill chain phase identifier.
      required:
        - phase_id
    ocsfv1.6.0httpactivityKillChainPhase_PhaseId:
      title: ocsfv1.6.0httpactivityKillChainPhase_PhaseId
      type: integer
      description: >-
        KillChainPhasePhaseId is an enum, and the following values are allowed.

        0 - Unknown: The kill chain phase is unknown.

        1 - Reconnaissance: The attackers pick a target and perform a detailed
        analysis, start collecting information (email addresses, conferences
        information, etc.) and evaluate the victim’s vulnerabilities to
        determine how to exploit them.

        2 - Weaponization: The attackers develop a malware weapon and aim to
        exploit the discovered vulnerabilities.

        3 - Delivery: The intruders will use various tactics, such as phishing,
        infected USB drives, etc.

        4 - Exploitation: The intruders start leveraging vulnerabilities to
        executed code on the victim’s system.

        5 - Installation: The intruders install malware on the victim’s system.

        6 - Control: Malware opens a command channel to enable the intruders to
        remotely manipulate the victim's system.

        7 - ActionsonObjectives: With hands-on keyboard access, intruders
        accomplish the mission’s goal.

        99 - Other: The kill chain phase is not mapped. See the
        <code>phase</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityLdapPerson:
      title: ocsfv1.6.0httpactivityLdapPerson
      type: object
      description: The additional LDAP attributes that describe a person.
      properties:
        cost_center:
          type: string
          nullable: true
          description: The cost center associated with the user.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp when the user was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user was created.
        deleted_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        deleted_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was deleted. In Active Directory (AD),
            when a user is deleted they are moved to a temporary container and
            then removed after 30 days. So, this field can be populated even
            after a user is deleted for the next 30 days.
        display_name:
          type: string
          nullable: true
          description: >-
            The display name of the LDAP person. According to RFC 2798, this is
            the preferred name of a person to be used when displaying entries.
        eligible_for_rehire:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the user is eligible for rehire. This typically
            applies to terminated or retired employees.
        email_addrs:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: A list of additional email addresses for the user.
        employee_uid:
          type: string
          nullable: true
          description: The employee identifier assigned to the user by the organization.
        employment_status:
          type: string
          nullable: true
          description: >-
            The employment status, normalized to the caption of the
            employment_status_id value. In the case of 'Other', it is defined by
            the data source.
        employment_status_date:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_date_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the employment status was last changed.
        employment_status_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityLdapPerson_EmploymentStatusId
          nullable: true
          description: The normalized identifier of the user's employment status.
        given_name:
          type: string
          nullable: true
          description: The given or first name of the user.
        hire_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        hire_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user was or will be hired by the
            organization.
        job_title:
          type: string
          nullable: true
          description: The user's job title.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels associated with the user. For example in AD this could be
            the <code>userType</code>, <code>employeeType</code>. For example:
            <code>Member, Employee</code>.
        last_login_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The last time when the user logged in.
        last_login_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The last time when the user logged in.
        ldap_cn:
          type: string
          nullable: true
          description: >-
            The LDAP and X.500 <code>commonName</code> attribute, typically the
            full name of the person. For example, <code>John Doe</code>.
        ldap_dn:
          type: string
          nullable: true
          description: >-
            The X.500 Distinguished Name (DN) is a structured string that
            uniquely identifies an entry, such as a user, in an X.500 directory
            service For example, <code>cn=John
            Doe,ou=People,dc=example,dc=com</code>.
        leave_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        leave_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the user left or will be leaving the
            organization.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLocation'
          nullable: true
          description: >-
            The geographical location associated with a user. This is typically
            the user's usual work location.
        manager:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            The user's manager. This helps in understanding an org hierarchy.
            This should only ever be populated once in an event. I.e. there
            should not be a manager's manager in an event.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp when the user entry was last modified.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp when the user entry was last modified.
        office_location:
          type: string
          nullable: true
          description: >-
            The primary office location associated with the user. This could be
            any string and isn't a specific address. For example, <code>South
            East Virtual</code>.
        phone_number:
          type: string
          nullable: true
          description: >-
            The telephone number of the user. Corresponds to the LDAP
            <code>Telephone-Number</code> CN.
        regrettable_termination:
          type: boolean
          nullable: true
          description: >-
            Indicates whether a termination is considered regrettable by the
            organization (i.e., loss of a valued employee). This is typically
            only populated for terminated employees.
        reports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            The user's direct reports. This is the inverse of the manager
            relationship, representing users who report directly to this user in
            the organizational hierarchy. This field only includes
            immediate/direct reports, not transitive reports.
        surname:
          type: string
          nullable: true
          description: The last or family name for the user.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            user.
    ocsfv1.6.0httpactivityLdapPerson_EmploymentStatusId:
      title: ocsfv1.6.0httpactivityLdapPerson_EmploymentStatusId
      type: integer
      description: >-
        LdapPersonEmploymentStatusId is an enum, and the following values are
        allowed.

        0 - Unknown: The employment status is unknown.

        1 - Applicant: The user is a job applicant or candidate who has not yet
        been hired.

        2 - Active: The user is currently employed and actively working.

        3 - Terminated: The user's employment has been terminated.

        4 - Retired: The user has retired from the organization.

        99 - Other: The employment status is not mapped. See the
        <code>employment_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityLoadBalancer:
      title: ocsfv1.6.0httpactivityLoadBalancer
      type: object
      description: >-
        The load balancer object describes the load balancer entity and contains
        additional information regarding the distribution of traffic across a
        network.
      properties:
        classification:
          type: string
          nullable: true
          description: The request classification as defined by the load balancer.
        code:
          type: integer
          nullable: true
          description: >-
            The numeric response status code detailing the connection from the
            load balancer to the destination target.
        dst_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkEndpoint'
          nullable: true
          description: The destination to which the load balancer is distributing traffic.
        endpoint_connections:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEndpointConnection'
          nullable: true
          description: >-
            An object detailing the load balancer connection attempts and
            responses.
        error_message:
          type: string
          nullable: true
          description: The load balancer error message.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: >-
            The IP address of the load balancer node that handled the client
            request. Note: the load balancer may have other IP addresses, and
            this is not an IP address of the target/distribution endpoint - see
            <code>dst_endpoint</code>.
        message:
          type: string
          nullable: true
          description: The load balancer message.
        metrics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityMetric'
          nullable: true
          description: General purpose metrics associated with the load balancer.
        name:
          type: string
          nullable: true
          description: The name of the load balancer.
        status_detail:
          type: string
          nullable: true
          description: >-
            The status detail contains additional status information about the
            load balancer distribution event.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the load balancer.
    ocsfv1.6.0httpactivityLocation:
      title: ocsfv1.6.0httpactivityLocation
      type: object
      description: >-
        The Geo Location object describes a geographical location, usually
        associated with an IP address.
      properties:
        aerial_height:
          type: string
          nullable: true
          description: >-
            Expressed as either height above takeoff location or height above
            ground level (AGL) for a UAS current location. This value is
            provided in meters and must have a minimum resolution of 1 m.
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        city:
          type: string
          nullable: true
          description: The name of the city.
        continent:
          type: string
          nullable: true
          description: The name of the continent.
        coordinates:
          type: array
          items:
            type: number
            format: double
          nullable: true
          description: >-
            A two-element array, containing a longitude/latitude pair. The
            format conforms with <a target="_blank"
            href="https://geojson.org">GeoJSON</a>. For example: <code>[-73.983,
            40.719]</code>.
        country:
          type: string
          nullable: true
          description: >-
            The ISO 3166-1 Alpha-2 country code.<p><b>Note:</b> The two letter
            country code should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        desc:
          type: string
          nullable: true
          description: The description of the geographical location.
        geodetic_altitude:
          type: string
          nullable: true
          description: >-
            The aircraft distance above or below the ellipsoid as measured along
            a line that passes through the aircraft and is normal to the surface
            of the WGS-84 ellipsoid. This value is provided in meters and must
            have a minimum resolution of 1 m. Special Values:
            <code>Invalid</code>, <code>No Value</code>, or <code>Unknown: -1000
            m</code>.
        geodetic_vertical_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on geodetic altitude. This is based on
            ADS-B Geodetic Vertical Accuracy (GVA). Measured in meters.
        geohash:
          type: string
          nullable: true
          description: >-
            <p>Geohash of the geo-coordinates (latitude and longitude).</p><a
            target="_blank"
            href="https://en.wikipedia.org/wiki/Geohash">Geohashing</a> is a
            geocoding system used to encode geographic coordinates in decimal
            degrees, to a single string.
        horizontal_accuracy:
          type: string
          nullable: true
          description: >-
            Provides quality/containment on horizontal position. This is based
            on ADS-B NACp. Measured in meters.
        is_on_premises:
          type: boolean
          nullable: true
          description: The indication of whether the location is on premises.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        lat:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Latitude coordinate represented in Decimal Degrees
            (DD). For example: <code>42.361145</code>.
        long:
          type: number
          format: double
          nullable: true
          description: >-
            The geographical Longitude coordinate represented in Decimal Degrees
            (DD). For example: <code>-71.057083</code>.
        postal_code:
          type: string
          nullable: true
          description: The postal code of the location.
        pressure_altitude:
          type: string
          nullable: true
          description: >-
            The uncorrected barometric pressure altitude (based on reference
            standard 29.92 inHg, 1013.25 mb) provides a reference for algorithms
            that utilize 'altitude deltas' between aircraft. This value is
            provided in meters and must have a minimum resolution of 1 m..
            Special Values: <code>Invalid</code>, <code>No Value</code>, or
            <code>Unknown: -1000 m</code>.
        provider:
          type: string
          nullable: true
          description: The provider of the geographical location data.
        region:
          type: string
          nullable: true
          description: >-
            The alphanumeric code that identifies the principal subdivision
            (e.g. province or state) of the country. For example, 'CH-VD' for
            the Canton of Vaud, Switzerland
        timezone:
          type: string
          nullable: true
          description: >-
            Timezone string. This provides timezone information that may be
            present even when latitude and longitude are absent.
    ocsfv1.6.0httpactivityLogger:
      title: ocsfv1.6.0httpactivityLogger
      type: object
      description: >-
        The Logger object represents the device and product where events are
        stored with times for receipt and transmission. This may be at the
        source device where the event occurred, a remote scanning device,
        intermediate hops, or the ultimate destination.
      properties:
        device:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDevice'
          nullable: true
          description: The device where the events are logged.
        event_uid:
          type: string
          nullable: true
          description: The unique identifier of the event assigned by the logger.
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the OCSF event data has been truncated due to size
            limitations. When <code>true</code>, some event data may have been
            omitted to fit within system constraints.
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        name:
          type: string
          nullable: true
          description: The name of the logging product instance.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: >-
            The product logging the event. This may be the event source product,
            a management server product, a scanning product, a SIEM, etc.
        transmit_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        transmit_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The time when the event was transmitted from the logging device to
            it's next destination.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the logging product instance.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The original size of the OCSF event data in kilobytes before any
            truncation occurred. This field is typically populated when
            <code>is_truncated</code> is <code>true</code> to indicate the full
            size of the original event.
        version:
          type: string
          nullable: true
          description: The version of the logging product.
    ocsfv1.6.0httpactivityLongString:
      title: ocsfv1.6.0httpactivityLongString
      type: object
      description: >-
        This object is a used to capture strings which may be truncated by a
        security product due to their length.
      properties:
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates that <code>value</code> has been truncated. May be omitted
            if truncation has not occurred.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The size in bytes of the string represented by <code>value</code>
            before truncation. Should be omitted if truncation has not occurred.
        value:
          type: string
          description: >-
            The string value, truncated if <code>is_truncated</code> is
            <code>true</code>.
      required:
        - value
    ocsfv1.6.0httpactivityMalware:
      title: ocsfv1.6.0httpactivityMalware
      type: object
      description: >-
        The Malware object describes the classification of known malicious
        software, which is intentionally designed to cause damage to a computer,
        server, client, or computer network.
      properties:
        classification_ids:
          type: array
          items:
            $ref: >-
              #/components/schemas/ocsfv1.6.0httpactivityMalware_ClassificationIds
          description: The list of normalized identifiers of the malware classifications.
        classifications:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of malware classifications, normalized to the captions of
            the <code>classification_ids</code> values. In the case of 'Other',
            they are defined by the event source.
        cves:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityCve'
          nullable: true
          description: >-
            The list of Common Vulnerabilities and Exposures (CVE) identifiers
            associated with the malware. Reference: <a target="_blank"
            href="https://cve.mitre.org/">CVE</a>
        files:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          nullable: true
          description: >-
            The list of file objects representing files that were identified as
            infected by the malware.
        name:
          type: string
          nullable: true
          description: The malware name, as reported by the detection engine.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The number of files that were identified to be infected by the
            malware.
        path:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFilePath'
          nullable: true
          description: The filesystem path of the malware that was observed.
        provider:
          type: string
          nullable: true
          description: >-
            The name or identifier of the security solution or service that
            provided the malware detection information.
        severity:
          type: string
          nullable: true
          description: >-
            The severity of the malware, normalized to the captions of the
            <code>severity_id</code> values. In the case of 'Other', they are
            defined by the event source.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMalware_SeverityId'
          nullable: true
          description: The normalized identifier of the malware severity.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the specific malware instance, as assigned
            by the detection engine (e.g., virus signature ID or IPS rule ID).
      required:
        - classification_ids
    ocsfv1.6.0httpactivityMalware_ClassificationIds:
      title: ocsfv1.6.0httpactivityMalware_ClassificationIds
      type: integer
      description: >-
        MalwareClassificationIds is an enum, and the following values are
        allowed.

        0 - Unknown: The classification is unknown.

        1 - Adware

        2 - Backdoor

        3 - Bot

        4 - Bootkit

        5 - DDOS

        6 - Downloader

        7 - Dropper

        8 - Kit

        9 - Keylogger

        10 - Ransomware

        11 - Access_Trojan

        13 - Exploitation

        14 - Security_Software

        15 - Rootkit

        16 - Capture

        17 - Spyware

        18 - Trojan

        19 - Virus

        20 - Webshell

        21 - Wiper

        22 - Worm

        99 - Other: The classification is not mapped. See the
        <code>classifications</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityMalware_SeverityId:
      title: ocsfv1.6.0httpactivityMalware_SeverityId
      type: integer
      description: >-
        MalwareSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityMalwareScanInfo:
      title: ocsfv1.6.0httpactivityMalwareScanInfo
      type: object
      description: >-
        The malware scan information object describes characteristics, metadata
        of a malware scanning job.
      properties:
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job completed execution.
        name:
          type: string
          nullable: true
          description: >-
            The administrator-supplied or application-generated name of the
            scan. For example: "Home office weekly user database scan", "Scan
            folders for viruses", "Full system virus scan"
        num_files:
          type: integer
          nullable: true
          description: The total number of files analyzed during the scan.
        num_infected:
          type: integer
          nullable: true
          description: >-
            The total number of files identified as infected with malware during
            the scan.
        num_volumes:
          type: integer
          nullable: true
          description: >-
            The total number of storage volumes examined during the malware
            scan.
        size:
          type: integer
          nullable: true
          description: The total size in bytes of all files that were scanned.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp indicating when the scan job began execution.
        targets:
          type: array
          items:
            type: string
          nullable: true
          description: Hosts or IP addresses targeted by the scan.
        type:
          type: string
          nullable: true
          description: The type of scan.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMalwareScanInfo_TypeId'
          description: The type id of the scan.
        uid:
          type: string
          nullable: true
          description: >-
            The application-defined unique identifier assigned to an instance of
            a scan.
        unique_malware_count:
          type: integer
          nullable: true
          description: The number of unique malware detected across all infected files.
      required:
        - type_id
    ocsfv1.6.0httpactivityMalwareScanInfo_TypeId:
      title: ocsfv1.6.0httpactivityMalwareScanInfo_TypeId
      type: integer
      description: >-
        MalwareScanInfoTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Manual: The scan was manually initiated by the user or
        administrator.

        2 - Scheduled: The scan was started based on scheduler.

        3 - UpdatedContent: The scan was triggered by a content update.

        4 - QuarantinedItems: The scan was triggered by newly quarantined items.

        5 - AttachedMedia: The scan was triggered by the attachment of removable
        media.

        6 - UserLogon: The scan was started due to a user logon.

        7 - ELAM: The scan was triggered by an Early Launch Anti-Malware (ELAM)
        detection.

        99 - Other: The scan type id is not mapped. See the <code>type</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityMetadata:
      title: ocsfv1.6.0httpactivityMetadata
      type: object
      description: The Metadata object describes the metadata associated with the event.
      properties:
        correlation_uid:
          type: string
          nullable: true
          description: The unique identifier used to correlate events.
        debug:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Debug information about non-fatal issues with this OCSF event. Each
            issue is a line in this string array.
        event_code:
          type: string
          nullable: true
          description: >-
            The <code>Event ID, Code, or Name</code> that the product uses to
            primarily identify the event.
        extension:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityExtension'
          nullable: true
          description: The schema extension used to create the event.
        extensions:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityExtension'
          nullable: true
          description: The schema extensions used to create the event.
        is_truncated:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the OCSF event data has been truncated due to size
            limitations. When <code>true</code>, some event data may have been
            omitted to fit within system constraints.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of labels attached to the event. For example:
            <code>["sample", "dev"]</code>
        log_level:
          type: string
          nullable: true
          description: The audit level at which an event was generated.
        log_name:
          type: string
          nullable: true
          description: >-
            The event log name. For example, syslog file name or Windows logging
            subsystem: Security.
        log_provider:
          type: string
          nullable: true
          description: >-
            The logging provider or logging service that logged the event. For
            example, Microsoft-Windows-Security-Auditing.
        log_version:
          type: string
          nullable: true
          description: >-
            The event log schema version that specifies the format of the
            original event. For example syslog version or Cisco Log Schema
            Version.
        logged_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        logged_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            <p>The time when the logging system collected and logged the
            event.</p>This attribute is distinct from the event time in that
            event time typically contain the time extracted from the original
            event. Most of the time, these two times will be different.
        loggers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityLogger'
          nullable: true
          description: >-
            An array of Logger objects that describe the devices and logging
            products between the event source and its eventual destination.
            Note, this attribute can be used when there is a complex end-to-end
            path of event flow.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the event was last modified or enriched.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the event was last modified or enriched.
        original_time:
          type: string
          nullable: true
          description: >-
            The original event time as reported by the event source. For
            example, the time in the original format from system event log such
            as Syslog on Unix/Linux and the System event file on Windows. Omit
            if event is generated instead of collected via logs.
        processed_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The event processed time, such as an ETL operation.
        processed_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The event processed time, such as an ETL operation.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          description: The product that reported the event.
        profiles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The list of profiles used to create the event. Profiles should be
            referenced by their <code>name</code> attribute for core profiles,
            or <code>extension/name</code> for profiles from extensions.
        sequence:
          type: integer
          nullable: true
          description: >-
            Sequence number of the event. The sequence number is a value
            available in some events, to make the exact ordering of events
            unambiguous, regardless of the event time precision.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            event.
        tenant_uid:
          type: string
          nullable: true
          description: The unique tenant identifier.
        transformation_info_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityTransformationInfo'
          nullable: true
          description: >-
            An array of transformation info that describes the mappings or
            transforms applied to the data.
        uid:
          type: string
          nullable: true
          description: The logging system-assigned unique identifier of an event instance.
        untruncated_size:
          type: integer
          nullable: true
          description: >-
            The original size of the OCSF event data in kilobytes before any
            truncation occurred. This field is typically populated when
            <code>is_truncated</code> is <code>true</code> to indicate the full
            size of the original event.
        version:
          type: string
          description: >-
            The version of the OCSF schema, using Semantic Versioning
            Specification (<a target="_blank"
            href="https://semver.org">SemVer</a>). For example:
            <code>1.0.0.</code> Event consumers use the version to determine the
            available event attributes.
      required:
        - product
        - version
    ocsfv1.6.0httpactivityMetric:
      title: ocsfv1.6.0httpactivityMetric
      type: object
      description: The Metric object defines a simple name/value pair entity for a metric.
      properties:
        name:
          type: string
          description: The name of the metric.
        value:
          type: string
          description: The value of the metric.
      required:
        - name
        - value
    ocsfv1.6.0httpactivityMitigation:
      title: ocsfv1.6.0httpactivityMitigation
      type: object
      description: >-
        The MITRE Mitigation object describes the ATT&amp;CK® or ATLAS™
        Mitigation ID and/or name that is associated to an attack.
      properties:
        countermeasures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityD3fend'
          nullable: true
          description: >-
            The D3FEND countermeasures that are associated with the attack
            technique. For example: ATT&amp;CK Technique <code>T1003</code> is
            addressed by Mitigation <code>M1027</code>, and D3FEND Technique
            <code>D3-OTP</code>.
        name:
          type: string
          nullable: true
          description: >-
            The Mitigation name that is associated with the attack technique.
            For example: <code>Password Policies</code>, or <code>Code
            Signing</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the Mitigation. For example:
            <code>https://attack.mitre.org/versions/v14/mitigations/M1027</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Mitigation ID that is associated with the attack technique. For
            example: <code>M1027</code>, or <code>AML.M0013</code>.
    ocsfv1.6.0httpactivityNetworkConnectionInfo:
      title: ocsfv1.6.0httpactivityNetworkConnectionInfo
      type: object
      description: >-
        The Network Connection Information object describes characteristics of
        an OSI Transport Layer communication, including TCP and UDP.
      properties:
        boundary:
          type: string
          nullable: true
          description: >-
            The boundary of the connection, normalized to the caption of
            'boundary_id'. In the case of 'Other', it is defined by the event
            source. <p> For cloud connections, this translates to the
            traffic-boundary(same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        boundary_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityNetworkConnectionInfo_BoundaryId
          nullable: true
          description: >-
            <p>The normalized identifier of the boundary of the connection.
            </p><p> For cloud connections, this translates to the
            traffic-boundary (same VPC, through IGW, etc.). For traditional
            networks, this is described as Local, Internal, or External.</p>
        community_uid:
          type: string
          nullable: true
          description: The Community ID of the network connection.
        direction:
          type: string
          nullable: true
          description: >-
            The direction of the initiated connection, traffic, or email,
            normalized to the caption of the direction_id value. In the case of
            'Other', it is defined by the event source.
        direction_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityNetworkConnectionInfo_DirectionId
          description: >-
            The normalized identifier of the direction of the initiated
            connection, traffic, or email.
        flag_history:
          type: string
          nullable: true
          description: >-
            The Connection Flag History summarizes events in a network
            connection. For example flags <code> ShAD </code> representing SYN,
            SYN/ACK, ACK and Data exchange.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). For example: <code>tcp</code> or
            <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The IP protocol number, as defined by the Internet Assigned Numbers
            Authority (IANA). For example: <code>6</code> for TCP and
            <code>17</code> for UDP.
        protocol_ver:
          type: string
          nullable: true
          description: The Internet Protocol version.
        protocol_ver_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityNetworkConnectionInfo_ProtocolVerId
          nullable: true
          description: The Internet Protocol version identifier.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySession'
          nullable: true
          description: The authenticated user or service session.
        tcp_flags:
          type: integer
          nullable: true
          description: The network connection TCP header flags (i.e., control bits).
        uid:
          type: string
          nullable: true
          description: The unique identifier of the connection.
      required:
        - direction_id
    ocsfv1.6.0httpactivityNetworkConnectionInfo_BoundaryId:
      title: ocsfv1.6.0httpactivityNetworkConnectionInfo_BoundaryId
      type: integer
      description: >-
        NetworkConnectionInfoBoundaryId is an enum, and the following values are
        allowed.

        0 - Unknown: The connection boundary is unknown.

        1 - Localhost: Local network traffic on the same endpoint.

        2 - Internal: Internal network traffic between two endpoints inside
        network.

        3 - External: External network traffic between two endpoints on the
        Internet or outside the network.

        4 - SameVPC: Through another resource in the same VPC

        5 - VPCGateway: Through an Internet gateway or a gateway VPC endpoint

        6 - VirtualPrivateGateway: Through a virtual private gateway

        7 - regionVPC: Through an intra-region VPC peering connection

        8 - regionVPC: Through an inter-region VPC peering connection

        9 - LocalGateway: Through a local gateway

        10 - GatewayVPC: Through a gateway VPC endpoint (Nitro-based instances
        only)

        11 - InternetGateway: Through an Internet gateway (Nitro-based instances
        only)

        99 - Other: The boundary is not mapped. See the <code>boundary</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityNetworkConnectionInfo_DirectionId:
      title: ocsfv1.6.0httpactivityNetworkConnectionInfo_DirectionId
      type: integer
      description: >-
        NetworkConnectionInfoDirectionId is an enum, and the following values
        are allowed.

        0 - Unknown: The connection direction is unknown.

        1 - Inbound: Inbound network connection. The connection was originated
        from the Internet or outside network, destined for services on the
        inside network.

        2 - Outbound: Outbound network connection. The connection was originated
        from inside the network, destined for services on the Internet or
        outside network.

        3 - Lateral: Lateral network connection. The connection was originated
        from inside the network, destined for services on the inside network.

        99 - Other: The direction is not mapped. See the <code>direction</code>
        attribute, which contains a data source specific value.
    ocsfv1.6.0httpactivityNetworkConnectionInfo_ProtocolVerId:
      title: ocsfv1.6.0httpactivityNetworkConnectionInfo_ProtocolVerId
      type: integer
      description: >-
        NetworkConnectionInfoProtocolVerId is an enum, and the following values
        are allowed.

        0 - Unknown: The protocol version is unknown.

        4 - IPv4*

        6 - IPv6*

        99 - Other: The protocol version is not mapped. See the
        <code>protocol_ver</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityNetworkEndpoint:
      title: ocsfv1.6.0httpactivityNetworkEndpoint
      type: object
      description: >-
        The Network Endpoint object describes characteristics of a network
        endpoint. These can be a source or destination of a network connection.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: >-
            The name of the domain that the endpoint belongs to or that
            corresponds to the endpoint.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkProxy'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkEndpoint_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.6.0httpactivityNetworkEndpoint_TypeId:
      title: ocsfv1.6.0httpactivityNetworkEndpoint_TypeId
      type: integer
      description: >-
        NetworkEndpointTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityNetworkInterface:
      title: ocsfv1.6.0httpactivityNetworkInterface
      type: object
      description: >-
        The Network Interface object describes the type and associated
        attributes of a physical or virtual network interface.
      properties:
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHostname'
          nullable: true
          description: The hostname associated with the network interface.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: The IP address associated with the network interface.
        ip_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of IP addresses available on the network interface.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMACAddress'
          nullable: true
          description: The MAC address of the network interface.
        mac_addresses:
          type: array
          items:
            type: string
          nullable: true
          description: A list of MAC addresses available on the network interface.
        name:
          type: string
          nullable: true
          description: The name of the network interface.
        namespace:
          type: string
          nullable: true
          description: >-
            The namespace is useful in merger or acquisition situations. For
            example, when similar entities exist that you need to keep separate.
        open_ports:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityPortInfo'
          nullable: true
          description: >-
            The list of open ports on a network interface, including port
            numbers and associated protocol information.
        subnet_prefix:
          type: integer
          nullable: true
          description: >-
            The subnet prefix length determines the number of bits used to
            represent the network part of the IP address. The remaining bits are
            reserved for identifying individual hosts within that subnet.
        type:
          type: string
          nullable: true
          description: The type of network interface.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkInterface_TypeId'
          nullable: true
          description: The network interface type identifier.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the network interface.
    ocsfv1.6.0httpactivityNetworkInterface_TypeId:
      title: ocsfv1.6.0httpactivityNetworkInterface_TypeId
      type: integer
      description: >-
        NetworkInterfaceTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Wired

        2 - Wireless

        3 - Mobile

        4 - Tunnel

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityNetworkProxy:
      title: ocsfv1.6.0httpactivityNetworkProxy
      type: object
      description: >-
        The network proxy endpoint object describes a proxy server, which acts
        as an intermediary between a client requesting a resource and the server
        providing that resource.
      properties:
        agent_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAgent'
          nullable: true
          description: >-
            A list of <code>agent</code> objects associated with a device,
            endpoint, or resource.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAutonomousSystem'
          nullable: true
          description: The Autonomous System details associated with an IP address.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        domain:
          type: string
          nullable: true
          description: >-
            The name of the domain that the endpoint belongs to or that
            corresponds to the endpoint.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHostname'
          nullable: true
          description: The fully qualified name of the endpoint.
        hw_info:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityDeviceHwInfo'
          nullable: true
          description: The endpoint hardware information.
        instance_uid:
          type: string
          nullable: true
          description: The unique identifier of a VM instance.
        interface_name:
          type: string
          nullable: true
          description: The name of the network interface (e.g. eth2).
        interface_uid:
          type: string
          nullable: true
          description: The unique identifier of the network interface.
        intermediate_ips:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: >-
            The intermediate IP Addresses. For example, the IP addresses in the
            HTTP X-Forwarded-For header.
        ip:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityIPAddress'
          nullable: true
          description: The IP address of the endpoint, in either IPv4 or IPv6 format.
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLocation'
          nullable: true
          description: The geographical location of the endpoint.
        mac:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityMACAddress'
          nullable: true
          description: The Media Access Control (MAC) address of the endpoint.
        name:
          type: string
          nullable: true
          description: The short name of the endpoint.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        os:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOs'
          nullable: true
          description: The endpoint operating system.
        owner:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: >-
            The identity of the service or user account that owns the endpoint
            or was last logged into it.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPort'
          nullable: true
          description: The port used for communication within the network connection.
        proxy_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            The network proxy information pertaining to a specific endpoint.
            This can be used to describe information pertaining to network
            address translation (NAT).
        subnet_uid:
          type: string
          nullable: true
          description: The unique identifier of a virtual subnet.
        svc_name:
          type: string
          nullable: true
          description: >-
            The service name in service-to-service connections. For example, AWS
            VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields
            identify the connection is coming from or going to an AWS service.
        type:
          type: string
          nullable: true
          description: >-
            The network endpoint type. For example: <code>unknown</code>,
            <code>server</code>, <code>desktop</code>, <code>laptop</code>,
            <code>tablet</code>, <code>mobile</code>, <code>virtual</code>,
            <code>browser</code>, or <code>other</code>.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityNetworkProxy_TypeId'
          nullable: true
          description: The network endpoint type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the endpoint.
        vlan_uid:
          type: string
          nullable: true
          description: The Virtual LAN identifier.
        vpc_uid:
          type: string
          nullable: true
          description: The unique identifier of the Virtual Private Cloud (VPC).
        zone:
          type: string
          nullable: true
          description: The network zone or LAN segment.
    ocsfv1.6.0httpactivityNetworkProxy_TypeId:
      title: ocsfv1.6.0httpactivityNetworkProxy_TypeId
      type: integer
      description: >-
        NetworkProxyTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Server: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Server/">server</a>.

        2 - Desktop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:DesktopComputer/">desktop
        computer</a>.

        3 - Laptop: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:LaptopComputer/">laptop
        computer</a>.

        4 - Tablet: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:TabletComputer/">tablet
        computer</a>.

        5 - Mobile: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:MobilePhone/">mobile
        phone</a>.

        6 - Virtual: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:VirtualizationSoftware/">virtual
        machine</a>.

        7 - IOT: An <a target="_blank"
        href="https://www.techtarget.com/iotagenda/definition/IoT-device">IOT
        (Internet of Things) device</a>.

        8 - Browser: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Browser/">web
        browser</a>.

        9 - Firewall: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Firewall/">networking
        firewall</a>.

        10 - Switch: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Switch/">networking
        switch</a>.

        11 - Hub: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Ethernet_hub">networking hub</a>.

        12 - Router: A <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:Router/">networking
        router</a>.

        13 - IDS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionDetectionSystem/">intrusion
        detection system</a>.

        14 - IPS: An <a target="_blank"
        href="https://d3fend.mitre.org/dao/artifact/d3f:IntrusionPreventionSystem/">intrusion
        prevention system</a>.

        15 - LoadBalancer: A <a target="_blank"
        href="https://en.wikipedia.org/wiki/Load_balancing_(computing)">Load
        Balancer device.</a>

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityNetworkTraffic:
      title: ocsfv1.6.0httpactivityNetworkTraffic
      type: object
      description: >-
        The Network Traffic object describes characteristics of network traffic.
        Network traffic refers to data moving across a network at a given point
        of time.
      properties:
        bytes:
          type: integer
          nullable: true
          description: The total number of bytes (in and out).
        bytes_in:
          type: integer
          nullable: true
          description: The number of bytes sent from the destination to the source.
        bytes_missed:
          type: integer
          nullable: true
          description: >-
            Indicates the number of bytes missed, which is representative of
            packet loss.
        bytes_out:
          type: integer
          nullable: true
          description: The number of bytes sent from the source to the destination.
        chunks:
          type: integer
          nullable: true
          description: The total number of chunks (in and out).
        chunks_in:
          type: integer
          nullable: true
          description: The number of chunks sent from the destination to the source.
        chunks_out:
          type: integer
          nullable: true
          description: The number of chunks sent from the source to the destination.
        packets:
          type: integer
          nullable: true
          description: The total number of packets (in and out).
        packets_in:
          type: integer
          nullable: true
          description: The number of packets sent from the destination to the source.
        packets_out:
          type: integer
          nullable: true
          description: The number of packets sent from the source to the destination.
    ocsfv1.6.0httpactivityObject:
      title: ocsfv1.6.0httpactivityObject
      type: object
      additionalProperties: true
      description: >-
        An unordered collection of attributes. It defines a set of attributes
        available in all objects. It can be also used as a generic object to log
        objects that are not otherwise defined by the schema.
    ocsfv1.6.0httpactivityObservable:
      title: ocsfv1.6.0httpactivityObservable
      type: object
      description: >-
        The observable object is a pivot element that contains related
        information found in many places in the event.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The full name of the observable attribute. The <code>name</code> is
            a pointer/reference to an attribute within the OCSF event data. For
            example: <code>file.name</code>.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityReputation'
          nullable: true
          description: Contains the original and normalized reputation scores.
        type:
          type: string
          nullable: true
          description: The observable value type name.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObservable_TypeId'
          description: The observable value type identifier.
        value:
          type: string
          nullable: true
          description: >-
            The value associated with the observable attribute. The meaning of
            the value depends on the observable type.<br />If the
            <code>name</code> refers to a scalar attribute, then the
            <code>value</code> is the value of the attribute.<br />If the
            <code>name</code> refers to an object attribute, then the
            <code>value</code> is not populated.
      required:
        - type_id
    ocsfv1.6.0httpactivityObservable_TypeId:
      title: ocsfv1.6.0httpactivityObservable_TypeId
      type: integer
      description: >-
        ObservableTypeId is an enum, and the following values are allowed.

        0 - Unknown: Unknown observable data type.

        1 - Hostname: Unique name assigned to a device connected to a computer
        network. It may be a fully qualified domain name (FQDN). For example:<br
        /><code>r2-d2.example.com.</code>,<br /><code>mx.example.com</code>

        2 - IPAddress: Internet Protocol address (IP address), in either IPv4 or
        IPv6 format. For example:<br /><code>192.168.200.24</code>, <br />
        <code>2001:0db8:85a3:0000:0000:8a2e:0370:7334</code>.

        3 - MACAddress: Media Access Control (MAC) address. For example:<br
        /><code>18:36:F3:98:4F:9A</code>.

        4 - UserName: User name. For example:<br /><code>john_doe</code>.

        5 - EmailAddress: Email address. For example:<br
        /><code>john_doe@example.com</code>.

        6 - URLString: Uniform Resource Locator (URL) string. For example:<br
        /><code>http://www.example.com/download/trouble.exe</code>.

        7 - FileName: File name. For example:<br /><code>text-file.txt</code>.

        8 - Hash: Hash. A unique value that corresponds to the content of the
        file, image, ja3_hash or hassh found in the schema. For example:<br />
        MD5: <code>3172ac7e2b55cbb81f04a6e65855a628</code>.

        9 - ProcessName: Process name. For example:<br /><code>Notepad</code>.

        10 - ResourceUID: Resource unique identifier. For example, S3 Bucket
        name or EC2 Instance ID.

        11 - Port: The TCP/UDP port number. For example:<br
        /><code>80</code>,<br /><code>22</code>.

        12 - Subnet: The subnet represented in a CIDR notation, using the format
        network_address/prefix_length. The network_address can be in either IPv4
        or IPv6 format. The prefix length indicates the number of bits used for
        the network portion, and the remaining bits are available for host
        addresses within that subnet. For example:<br
        /><code>192.168.1.0/24</code>,<br
        /><code>2001:0db8:85a3:0000::/64</code>

        20 - Endpoint: The Endpoint object describes a physical or virtual
        device that connects to and exchanges information with a computer
        network. Some examples of endpoints are mobile devices, desktop
        computers, virtual machines, embedded devices, and servers.
        Internet-of-Things devices—like cameras, lighting, refrigerators,
        security systems, smart speakers, and thermostats—are also endpoints.

        21 - User: The User object describes the characteristics of a
        user/person or a security principal.

        22 - Email: The Email object describes the email metadata such as
        sender, recipients, and direction, and can include embedded URLs and
        files.

        23 - UniformResourceLocator: The Uniform Resource Locator (URL) object
        describes the characteristics of a URL.

        24 - File: The File object represents the metadata associated with a
        file stored in a computer system. It encompasses information about the
        file itself, including its attributes, properties, and organizational
        details.

        25 - Process: The Process object describes a running instance of a
        launched program.

        26 - GeoLocation: The Geo Location object describes a geographical
        location, usually associated with an IP address.

        27 - Container: The Container object describes an instance of a specific
        container. A container is a prepackaged, portable system image that runs
        isolated on an existing system using a container runtime like
        containerd.

        30 - Fingerprint: The Fingerprint object provides detailed information
        about a digital fingerprint, which is a compact representation of data
        used to identify a longer piece of information, such as a public key or
        file content. It contains the algorithm and value of the fingerprint,
        enabling efficient and reliable identification of the associated data.

        45 - FilePath: The full path to the file. For example: For example:<br
        /><code>c:\windows\system32\svchost.exe</code>.

        99 - Other: The observable data type is not mapped. See the
        <code>type</code> attribute, which may contain data source specific
        value.
    ocsfv1.6.0httpactivityOrganization:
      title: ocsfv1.6.0httpactivityOrganization
      type: object
      description: >-
        The Organization object describes characteristics of an organization or
        company and its division if any. Additionally, it also describes cloud
        and Software-as-a-Service (SaaS) logical hierarchies such as AWS
        Organizations, Google Cloud Organizations, Oracle Cloud Tenancies, and
        similar constructs.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the organization, Oracle Cloud Tenancy, Google Cloud
            Organization, or AWS Organization. For example, <code> Widget, Inc.
            </code> or the <code> AWS Organization name </code>.
        ou_name:
          type: string
          nullable: true
          description: >-
            The name of an organizational unit, Google Cloud Folder, or AWS Org
            Unit. For example, the <code> GCP Project Name </code>, or <code>
            Dev_Prod_OU </code>.
        ou_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of an organizational unit, Google Cloud
            Folder, or AWS Org Unit. For example, an <code> Oracle Cloud Tenancy
            ID </code>, <code> AWS OU ID </code>, or <code> GCP Folder ID
            </code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the organization, Oracle Cloud Tenancy,
            Google Cloud Organization, or AWS Organization. For example, an
            <code> AWS Org ID </code> or <code> Oracle Cloud Domain ID </code>.
    ocsfv1.6.0httpactivityOs:
      title: ocsfv1.6.0httpactivityOs
      type: object
      description: >-
        The Operating System (OS) object describes characteristics of an OS,
        such as Linux or Windows.
      properties:
        build:
          type: string
          nullable: true
          description: The operating system build number.
        country:
          type: string
          nullable: true
          description: >-
            The operating system country code, as defined by the ISO 3166-1
            standard (Alpha-2 code).<p><b>Note:</b> The two letter country code
            should be capitalized. For example: <code>US</code> or
            <code>CA</code>.</p>
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        cpu_bits:
          type: integer
          nullable: true
          description: >-
            The cpu architecture, the number of bits used for addressing in
            memory. For example: <code>32</code> or <code>64</code>.
        edition:
          type: string
          nullable: true
          description: >-
            The operating system edition. For example:
            <code>Professional</code>.
        kernel_release:
          type: string
          nullable: true
          description: >-
            The kernel release of the operating system. On Unix-based systems,
            this is determined from the <code>uname -r</code> command output,
            for example "5.15.0-122-generic".
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          description: The operating system name.
        sp_name:
          type: string
          nullable: true
          description: The name of the latest Service Pack.
        sp_ver:
          type: integer
          nullable: true
          description: The version number of the latest Service Pack.
        type:
          type: string
          nullable: true
          description: The type of the operating system.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOs_TypeId'
          description: The type identifier of the operating system.
        version:
          type: string
          nullable: true
          description: >-
            The version of the OS running on the device that originated the
            event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
      required:
        - name
        - type_id
    ocsfv1.6.0httpactivityOs_TypeId:
      title: ocsfv1.6.0httpactivityOs_TypeId
      type: integer
      description: >-
        OsTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.

        100 - Windows

        101 - WindowsMobile

        200 - Linux

        201 - Android

        300 - macOS

        301 - iOS

        302 - iPadOS

        400 - Solaris

        401 - AIX

        402 - UX
    ocsfv1.6.0httpactivityOsint:
      title: ocsfv1.6.0httpactivityOsint
      type: object
      description: >-
        The OSINT (Open Source Intelligence) object contains details related to
        an indicator such as the indicator itself, related indicators,
        geolocation, registrar information, subdomains, analyst commentary, and
        other contextual information. This information can be used to further
        enrich a detection or finding by providing decisioning support to other
        analysts and engineers.
      properties:
        answers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityDnsAnswer'
          nullable: true
          description: >-
            Any pertinent DNS answers information related to an indicator or
            OSINT analysis.
        attacks:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAttack'
          nullable: true
          description: >-
            MITRE ATT&amp;CK Tactics, Techniques, and/or Procedures (TTPs)
            pertinent to an indicator or OSINT analysis.
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAutonomousSystem'
          nullable: true
          description: >-
            Any pertinent autonomous system information related to an indicator
            or OSINT analysis.
        campaign:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCampaign'
          nullable: true
          description: >-
            The campaign object describes details about the campaign that was
            the source of the activity.
        category:
          type: string
          nullable: true
          description: >-
            Categorizes the threat indicator based on its functional or
            operational role.
        comment:
          type: string
          nullable: true
          description: >-
            Analyst commentary or source commentary about an indicator or OSINT
            analysis.
        confidence:
          type: string
          nullable: true
          description: >-
            The confidence of an indicator being malicious and/or pertinent,
            normalized to the caption of the confidence_id value. In the case of
            'Other', it is defined by the event source or analyst.
        confidence_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOsint_ConfidenceId'
          nullable: true
          description: >-
            The normalized confidence refers to the accuracy of collected
            information related to the OSINT or how pertinent an indicator or
            analysis is to a specific event or finding. A low confidence means
            that the information collected or analysis conducted lacked detail
            or is not accurate enough to qualify an indicator as fully
            malicious.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when the indicator was initially created or
            identified.
        creator:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: >-
            The identifier of the user, system, or organization that contributed
            the indicator.
        desc:
          type: string
          nullable: true
          description: >-
            A detailed explanation of the indicator, including its context,
            purpose, and relevance.
        detection_pattern:
          type: string
          nullable: true
          description: >-
            The specific detection pattern or signature associated with the
            indicator.
        detection_pattern_type:
          type: string
          nullable: true
          description: >-
            The detection pattern type, normalized to the caption of the
            detection_pattern_type_id value. In the case of 'Other', it is
            defined by the event source.
        detection_pattern_type_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityOsint_DetectionPatternTypeId
          nullable: true
          description: >-
            Specifies the type of detection pattern used to identify the
            associated threat indicator.
        email:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmail'
          nullable: true
          description: Any email information pertinent to an indicator or OSINT analysis.
        email_auth:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAuth'
          nullable: true
          description: >-
            Any email authentication information pertinent to an indicator or
            OSINT analysis.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The expiration date of the indicator, after which it is no longer
            considered reliable.
        external_uid:
          type: string
          nullable: true
          description: >-
            A unique identifier assigned by an external system for
            cross-referencing.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          nullable: true
          description: >-
            Any pertinent file information related to an indicator or OSINT
            analysis.
        intrusion_sets:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A grouping of adversarial behaviors and resources believed to be
            associated with specific threat actors or campaigns. Intrusion sets
            often encompass multiple campaigns and are used to organize related
            activities under a common label.
        kill_chain:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKillChainPhase'
          nullable: true
          description: >-
            Lockheed Martin Kill Chain Phases pertinent to an indicator or OSINT
            analysis.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Tags or keywords associated with the indicator to enhance
            searchability.
        location:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLocation'
          nullable: true
          description: >-
            Any pertinent geolocation information related to an indicator or
            OSINT analysis.
        malware:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityMalware'
          nullable: true
          description: >-
            A list of Malware objects, describing details about the identified
            malware.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The timestamp of the last modification or update to the indicator.
        name:
          type: string
          nullable: true
          description: >-
            The <code>name</code> is a pointer/reference to an attribute within
            the OCSF event data. For example: file.name.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Provides a reference to an external source of information related to
            the CTI being represented. This may include a URL, a document, or
            some other type of reference that provides additional context or
            information about the CTI.
        related_analytics:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAnalytic'
          nullable: true
          description: Any analytics related to an indicator or OSINT analysis.
        reputation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityReputation'
          nullable: true
          description: >-
            Related reputational analysis from third-party engines and analysts
            for a given indicator or OSINT analysis.
        risk_score:
          type: integer
          nullable: true
          description: A numerical representation of the threat indicator’s risk level.
        script:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityScript'
          nullable: true
          description: >-
            Any pertinent script information related to an indicator or OSINT
            analysis.
        severity:
          type: string
          nullable: true
          description: >-
            Represents the severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        severity_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOsint_SeverityId'
          nullable: true
          description: >-
            The normalized severity level of the threat indicator, typically
            reflecting its potential impact or damage.
        signatures:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityDigitalSignature'
          nullable: true
          description: >-
            Any digital signatures or hashes related to an indicator or OSINT
            analysis.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The source URL of an indicator or OSINT analysis, e.g., a URL back
            to a TIP, report, or otherwise.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Any pertinent subdomain information - such as those generated by a
            Domain Generation Algorithm - related to an indicator or OSINT
            analysis.
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySubnet'
          nullable: true
          description: A CIDR or network block related to an indicator or OSINT analysis.
        threat_actor:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityThreatActor'
          nullable: true
          description: >-
            A threat actor is an individual or group that conducts malicious
            cyber activities, often with financial, political, or ideological
            motives.
        tlp:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOsint_Tlp'
          nullable: true
          description: >-
            The <a target='_blank' href='https://www.first.org/tlp/'>Traffic
            Light Protocol</a> was created to facilitate greater sharing of
            potentially sensitive information and more effective collaboration.
            TLP provides a simple and intuitive schema for indicating with whom
            potentially sensitive information can be shared.
        type:
          type: string
          nullable: true
          description: The OSINT indicator type.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOsint_TypeId'
          description: The OSINT indicator type ID.
        uid:
          type: string
          nullable: true
          description: The unique identifier for the OSINT object.
        uploaded_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        uploaded_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp indicating when the associated indicator or
            intelligence was added to the system or repository.
        value:
          type: string
          description: >-
            The actual indicator value in scope, e.g., a SHA-256 hash hexdigest
            or a domain name.
        vendor_name:
          type: string
          nullable: true
          description: >-
            The vendor name of a tool which generates intelligence or provides
            indicators.
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityVulnerability'
          nullable: true
          description: Any vulnerabilities related to an indicator or OSINT analysis.
        whois:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityWhois'
          nullable: true
          description: >-
            Any pertinent WHOIS information related to an indicator or OSINT
            analysis.
      required:
        - type_id
        - value
    ocsfv1.6.0httpactivityOsint_ConfidenceId:
      title: ocsfv1.6.0httpactivityOsint_ConfidenceId
      type: integer
      description: >-
        OsintConfidenceId is an enum, and the following values are allowed.

        0 - Unknown: The normalized confidence is unknown.

        1 - Low

        2 - Medium

        3 - High

        99 - Other: The confidence is not mapped to the defined enum values. See
        the <code>confidence</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityOsint_DetectionPatternTypeId:
      title: ocsfv1.6.0httpactivityOsint_DetectionPatternTypeId
      type: integer
      description: >-
        OsintDetectionPatternTypeId is an enum, and the following values are
        allowed.

        0 - Unknown: The type is not mapped.

        1 - STIX

        2 - PCRE

        3 - SIGMA

        4 - Snort

        5 - Suricata

        6 - YARA

        99 - Other: The detection pattern type is not mapped. See the
        <code>detection_pattern_type</code> attribute, which contains a data
        source specific value.
    ocsfv1.6.0httpactivityOsint_SeverityId:
      title: ocsfv1.6.0httpactivityOsint_SeverityId
      type: integer
      description: >-
        OsintSeverityId is an enum, and the following values are allowed.

        0 - Unknown: The event/finding severity is unknown.

        1 - Informational: Informational message. No action required.

        2 - Low: The user decides if action is needed.

        3 - Medium: Action is required but the situation is not serious at this
        time.

        4 - High: Action is required immediately.

        5 - Critical: Action is required immediately and the scope is broad.

        6 - Fatal: An error occurred but it is too late to take remedial action.

        99 - Other: The event/finding severity is not mapped. See the
        <code>severity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityOsint_Tlp:
      title: ocsfv1.6.0httpactivityOsint_Tlp
      type: string
      description: >-
        OsintTlp is an enum, and the following values are allowed.

        AMBER - AMBER: TLP:AMBER is for limited disclosure, recipients can only
        spread this on a need-to-know basis within their organization and its
        clients. Note that TLP:AMBER+STRICT restricts sharing to the
        organization only. Sources may use TLP:AMBER when information requires
        support to be effectively acted upon, yet carries risk to privacy,
        reputation, or operations if shared outside of the organizations
        involved. Recipients may share TLP:AMBER information with members of
        their own organization and its clients, but only on a need-to-know basis
        to protect their organization and its clients and prevent further harm.
        Note: if the source wants to restrict sharing to the organization only,
        they must specify TLP:AMBER+STRICT.

        AMBER STRICT - AMBER_STRICT: TLP:AMBER is for limited disclosure,
        recipients can only spread this on a need-to-know basis within their
        organization and its clients. Note that TLP:AMBER+STRICT restricts
        sharing to the organization only. Sources may use TLP:AMBER when
        information requires support to be effectively acted upon, yet carries
        risk to privacy, reputation, or operations if shared outside of the
        organizations involved. Recipients may share TLP:AMBER information with
        members of their own organization and its clients, but only on a
        need-to-know basis to protect their organization and its clients and
        prevent further harm. Note: if the source wants to restrict sharing to
        the organization only, they must specify TLP:AMBER+STRICT.

        CLEAR - CLEAR: TLP:CLEAR denotes that recipients can spread this to the
        world, there is no limit on disclosure. Sources may use TLP:CLEAR when
        information carries minimal or no foreseeable risk of misuse, in
        accordance with applicable rules and procedures for public release.
        Subject to standard copyright rules, TLP:CLEAR information may be shared
        without restriction.

        GREEN - GREEN: TLP:GREEN is for limited disclosure, recipients can
        spread this within their community. Sources may use TLP:GREEN when
        information is useful to increase awareness within their wider
        community. Recipients may share TLP:GREEN information with peers and
        partner organizations within their community, but not via publicly
        accessible channels. TLP:GREEN information may not be shared outside of
        the community. Note: when “community” is not defined, assume the
        cybersecurity/defense community.

        RED - RED: TLP:RED is for the eyes and ears of individual recipients
        only, no further disclosure. Sources may use TLP:RED when information
        cannot be effectively acted upon without significant risk for the
        privacy, reputation, or operations of the organizations involved.
        Recipients may therefore not share TLP:RED information with anyone else.
        In the context of a meeting, for example, TLP:RED information is limited
        to those present at the meeting.

        WHITE - WHITE: TLP:WHITE and TLP:CLEAR may be used interchangeably,
        TLP:WHITE is the most up to date (as of TLP 2.0) usage.
    ocsfv1.6.0httpactivityOsint_TypeId:
      title: ocsfv1.6.0httpactivityOsint_TypeId
      type: integer
      description: >-
        OsintTypeId is an enum, and the following values are allowed.

        0 - Unknown: The indicator type is ambiguous or there is not a related
        indicator for the OSINT object.

        1 - IPAddress: An IPv4 or IPv6 address.

        2 - Domain: A full-qualified domain name (FQDN), subdomain, or partial
        domain.

        3 - Hostname: A hostname or computer name.

        4 - Hash: Any type of hash e.g., MD5, SHA1, SHA2, BLAKE, BLAKE2, SSDEEP,
        VHASH, etc. generated from a file, malware sample, request header, or
        otherwise used to identify a pertinent artifact.

        5 - URL: A Uniform Resource Locator (URL) or Uniform Resource Indicator
        (URI).

        6 - UserAgent: A User Agent typically seen in HTTP request headers.

        7 - DigitalCertificate: The serial number, fingerprint, or full content
        of an X.509 digital certificate.

        8 - Email: The contents of an email or any related information to an
        email object.

        9 - EmailAddress: An email address.

        10 - Vulnerability: A CVE ID, CWE ID, or other identifier for a
        weakness, exploit, bug, or misconfiguration.

        11 - File: A file or metadata about a file.

        12 - RegistryKey: A Windows Registry Key.

        13 - RegistryValue: A Windows Registry Value.

        14 - CommandLine: A partial or full Command Line used to invoke scripts
        or other remote commands.

        99 - Other: The indicator type is not directly listed.
    ocsfv1.6.0httpactivityPackage:
      title: ocsfv1.6.0httpactivityPackage
      type: object
      description: The Software Package object describes details about a software package.
      properties:
        architecture:
          type: string
          nullable: true
          description: >-
            Architecture is a shorthand name describing the type of computer
            hardware the packaged software is meant to run on.
        cpe_name:
          type: string
          nullable: true
          description: The Common Platform Enumeration (CPE) name for the software package.
        epoch:
          type: integer
          nullable: true
          description: >-
            The software package epoch. Epoch is a way to define weighted
            dependencies based on version numbers.
        hash:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: >-
            Cryptographic hash to identify the binary instance of a software
            component. This can include any component such file, package, or
            library.
        license:
          type: string
          nullable: true
          description: The software license applied to this package.
        license_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The URL pointing to the license applied on package or software. This
            is typically a <code>LICENSE.md</code> file within a repository.
        name:
          type: string
          description: The software package name.
        package_manager:
          type: string
          nullable: true
          description: >-
            The software packager manager utilized to manage a package on a
            system, e.g. npm, yum, dpkg etc.
        package_manager_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The URL of the package or library at the package manager, or the
            specific URL or URI of an internal package manager link such as
            <code>AWS CodeArtifact</code> or <code>Artifactory</code>.
        purl:
          type: string
          nullable: true
          description: >-
            A purl is a URL string used to identify and locate a software
            package in a mostly universal and uniform way across programming
            languages, package managers, packaging conventions, tools, APIs and
            databases.
        release:
          type: string
          nullable: true
          description: >-
            Release is the number of times a version of the software has been
            packaged.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The link to the specific library or package such as within
            <code>GitHub</code>, this is different from the link to the package
            manager where the library or package is hosted.
        type:
          type: string
          nullable: true
          description: >-
            The type of software package, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPackage_TypeId'
          nullable: true
          description: The type of software package.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for the package or library reported by the
            source tool. E.g., the <code>libId</code> within the
            <code>sbom</code> field of an OX Security Issue or the SPDX
            <code>components.\*.bom-ref</code>.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor who published the software package.
        version:
          type: string
          description: The software package version.
      required:
        - name
        - version
    ocsfv1.6.0httpactivityPackage_TypeId:
      title: ocsfv1.6.0httpactivityPackage_TypeId
      type: integer
      description: >-
        PackageTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Application: An application software package.

        2 - OperatingSystem: An operating system software package.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityPolicy:
      title: ocsfv1.6.0httpactivityPolicy
      type: object
      description: >-
        The Policy object describes the policies that are applicable. <p>Policy
        attributes provide traceability to the operational state of the security
        product at the time that the event was captured, facilitating forensics,
        troubleshooting, and policy tuning/adjustments.</p>
      properties:
        data:
          nullable: true
          description: >-
            Additional data about the policy such as the underlying JSON policy
            itself or other details.
        desc:
          type: string
          nullable: true
          description: The description of the policy.
        group:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityGroup'
          nullable: true
          description: The policy group.
        is_applied:
          type: boolean
          nullable: true
          description: >-
            A determination if the content of a policy was applied to a target
            or request, or not.
        name:
          type: string
          nullable: true
          description: >-
            The policy name. For example: <code>AdministratorAccess
            Policy</code>.
        type:
          type: string
          nullable: true
          description: >-
            The policy type. For example: <code>Identity Policy, Resource
            Policy, Service Control Policy, etc./code&gt;.</code>
        uid:
          type: string
          nullable: true
          description: A unique identifier of the policy instance.
        version:
          type: string
          nullable: true
          description: The policy version number.
    ocsfv1.6.0httpactivityPortInfo:
      title: ocsfv1.6.0httpactivityPortInfo
      type: object
      description: >-
        The Port Information object describes a port and its associated protocol
        details.
      properties:
        port:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPort'
          description: >-
            The port number. For example: <code>80</code>, <code>443</code>,
            <code>22</code>.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The IP protocol name in lowercase, as defined by the Internet
            Assigned Numbers Authority (IANA). For example: <code>tcp</code> or
            <code>udp</code>.
        protocol_num:
          type: integer
          nullable: true
          description: >-
            The IP protocol number, as defined by the Internet Assigned Numbers
            Authority (IANA). For example: <code>6</code> for TCP and
            <code>17</code> for UDP.
      required:
        - port
    ocsfv1.6.0httpactivityProcess:
      title: ocsfv1.6.0httpactivityProcess
      type: object
      description: The Process object describes a running instance of a launched program.
      properties:
        ancestry:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityProcessEntity'
          nullable: true
          description: >-
            An array of Process Entities describing the extended parentage of
            this process object. Direct parent information should be expressed
            through the <code>parent_process</code> attribute. The first array
            element is the direct parent of this process object. Subsequent list
            elements go up the process parentage hierarchy. That is, the array
            is sorted from newest to oldest process. It is recommended to only
            populate this field for the top-level process object.
        auid:
          type: integer
          nullable: true
          description: The audit user assigned at login by the audit subsystem.
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        container:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityContainer'
          nullable: true
          description: >-
            The information describing an instance of a container. A container
            is a prepackaged, portable system image that runs isolated on an
            existing system using a container runtime like containerd.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        egid:
          type: integer
          nullable: true
          description: The effective group under which this process is running.
        environment_variables:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityEnvironmentVariable'
          nullable: true
          description: Environment variables associated with the process.
        euid:
          type: integer
          nullable: true
          description: The effective user under which this process is running.
        file:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          nullable: true
          description: The process file object.
        group:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityGroup'
          nullable: true
          description: The group under which this process is running.
        integrity:
          type: string
          nullable: true
          description: >-
            The process integrity level, normalized to the caption of the
            integrity_id value. In the case of 'Other', it is defined by the
            event source (Windows only).
        integrity_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProcess_IntegrityId'
          nullable: true
          description: >-
            The normalized identifier of the process integrity level (Windows
            only).
        lineage:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityFilePath'
          nullable: true
          description: >-
            The lineage of the process, represented by a list of paths for each
            ancestor process. For example: <code>['/usr/sbin/sshd',
            '/usr/bin/bash', '/usr/bin/whoami']</code>.
        loaded_modules:
          type: array
          items:
            type: string
          nullable: true
          description: The list of loaded module names.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        namespace_pid:
          type: integer
          nullable: true
          description: >-
            If running under a process namespace (such as in a container), the
            process identifier within that process namespace.
        parent_process:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            The parent process of this process object. It is recommended to only
            populate this field for the top-level process object, to prevent
            deep nesting. Additional ancestry information can be supplied in the
            <code>ancestry</code> attribute.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        ptid:
          type: integer
          nullable: true
          description: >-
            The identifier of the process thread associated with the event, as
            returned by the operating system.
        sandbox:
          type: string
          nullable: true
          description: >-
            The name of the containment jail (i.e., sandbox). For example,
            hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps.
        session:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySession'
          nullable: true
          description: The user session under which this process is running.
        terminated_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the process was terminated.
        terminated_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was terminated.
        tid:
          type: integer
          nullable: true
          description: >-
            The identifier of the thread associated with the event, as returned
            by the operating system.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
        user:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser'
          nullable: true
          description: The user under which this process is running.
        working_directory:
          type: string
          nullable: true
          description: The working directory of a process.
        xattributes:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityObject'
          nullable: true
          description: >-
            An unordered collection of zero or more name/value pairs that
            represent a process extended attribute.
    ocsfv1.6.0httpactivityProcess_IntegrityId:
      title: ocsfv1.6.0httpactivityProcess_IntegrityId
      type: integer
      description: >-
        ProcessIntegrityId is an enum, and the following values are allowed.

        0 - Unknown: The integrity level is unknown.

        1 - Untrusted

        2 - Low

        3 - Medium

        4 - High

        5 - System

        6 - Protected

        99 - Other: The integrity level is not mapped. See the
        <code>integrity</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityProcessEntity:
      title: ocsfv1.6.0httpactivityProcessEntity
      type: object
      description: >-
        The Process Entity object provides critical fields for referencing a
        process.
      properties:
        cmd_line:
          type: string
          nullable: true
          description: >-
            The full command line used to launch an application, service,
            process, or job. For example: <code>ssh user@10.0.0.10</code>. If
            the command line is unavailable or missing, the empty string
            <code>''</code> is to be used.
        cpid:
          type: string
          nullable: true
          description: >-
            A unique process identifier that can be assigned deterministically
            by multiple system data producers.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the process was created/started.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the process was created/started.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProcessName'
          nullable: true
          description: >-
            The friendly name of the process, for example:
            <code>Notepad++</code>.
        path:
          type: string
          nullable: true
          description: The process file path.
        pid:
          type: integer
          nullable: true
          description: >-
            The process identifier, as reported by the operating system. Process
            ID (PID) is a number used by the operating system to uniquely
            identify an active process.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for this process assigned by the producer
            (tool). Facilitates correlation of a process event with other events
            for that process.
    ocsfv1.6.0httpactivityProduct:
      title: ocsfv1.6.0httpactivityProduct
      type: object
      description: The Product object describes characteristics of a software product.
      properties:
        cpe_name:
          type: string
          nullable: true
          description: >-
            The Common Platform Enumeration (CPE) name as described by (<a
            target="_blank" href="https://nvd.nist.gov/products/cpe">NIST</a>)
            For example: <code>cpe:/a:apple:safari:16.2</code>.
        distribution_mode:
          type: string
          nullable: true
          description: >-
            Indicates the source from which the app was installed, such as the
            app store.
        feature:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFeature'
          nullable: true
          description: The feature that reported the event.
        lang:
          type: string
          nullable: true
          description: >-
            The two letter lower case language codes, as defined by <a
            target="_blank" href="https://en.wikipedia.org/wiki/ISO_639-1">ISO
            639-1</a>. For example: <code>en</code> (English), <code>de</code>
            (German), or <code>fr</code> (French).
        name:
          type: string
          nullable: true
          description: The name of the product.
        path:
          type: string
          nullable: true
          description: The installation path of the product.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the product.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: The URL pointing towards the product.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor of the product.
        version:
          type: string
          nullable: true
          description: >-
            The version of the product, as defined by the event source. For
            example: <code>2013.1.3-beta</code>.
        workload:
          type: string
          nullable: true
          description: The product workload associated with the event.
    ocsfv1.6.0httpactivityProgrammaticCredential:
      title: ocsfv1.6.0httpactivityProgrammaticCredential
      type: object
      description: >-
        The Programmatic Credential object describes service-specific
        credentials used for direct API access and system integration. These
        credentials are typically issued by individual services or platforms for
        accessing their APIs and resources, focusing on credential lifecycle
        management and usage tracking. Examples include API keys, service
        account keys, client certificates, and vendor-specific access tokens.
      properties:
        last_used_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The timestamp when this programmatic credential was last used for
            authentication or API access. This helps track credential usage
            patterns, identify dormant credentials that may pose security risks,
            and support credential lifecycle management. The timestamp should
            reflect the most recent successful authentication or API call using
            this credential.
        last_used_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The timestamp when this programmatic credential was last used for
            authentication or API access. This helps track credential usage
            patterns, identify dormant credentials that may pose security risks,
            and support credential lifecycle management. The timestamp should
            reflect the most recent successful authentication or API call using
            this credential.
        type:
          type: string
          nullable: true
          description: >-
            The type or category of programmatic credential, normalized to the
            caption of the type_id value. In the case of 'Other', it is defined
            by the event source. Examples include 'API Key', 'Service Account
            Key', 'Access Token', 'Client Certificate', 'OAuth Token', 'Personal
            Access Token', etc.
        uid:
          type: string
          description: >-
            The unique identifier of the programmatic credential. This could be
            an API key ID, service account key ID, access token identifier,
            certificate serial number, or other unique identifier that
            distinguishes this credential from others. Examples: AWS Access Key
            ID, GCP Service Account Key ID, Azure Application ID, or OAuth2
            token identifier.
      required:
        - uid
    ocsfv1.6.0httpactivityRemediation:
      title: ocsfv1.6.0httpactivityRemediation
      type: object
      description: >-
        The Remediation object describes the recommended remediation steps to
        address identified issue(s).
      properties:
        cis_controls:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityCisControl'
          nullable: true
          description: >-
            An array of Center for Internet Security (CIS) Controls that can be
            optionally mapped to provide additional remediation details.
        desc:
          type: string
          description: The description of the remediation strategy.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of supporting URL/s, references that help describe the
            remediation strategy.
      required:
        - desc
    ocsfv1.6.0httpactivityReputation:
      title: ocsfv1.6.0httpactivityReputation
      type: object
      description: >-
        The Reputation object describes the reputation/risk score of an entity
        (e.g. device, user, domain).
      properties:
        base_score:
          type: number
          format: double
          description: The reputation score as reported by the event source.
        provider:
          type: string
          nullable: true
          description: The provider of the reputation information.
        score:
          type: string
          nullable: true
          description: >-
            The reputation score, normalized to the caption of the score_id
            value. In the case of 'Other', it is defined by the event source.
        score_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityReputation_ScoreId'
          description: The normalized reputation score identifier.
      required:
        - base_score
        - score_id
    ocsfv1.6.0httpactivityReputation_ScoreId:
      title: ocsfv1.6.0httpactivityReputation_ScoreId
      type: integer
      description: >-
        ReputationScoreId is an enum, and the following values are allowed.

        0 - Unknown: The reputation score is unknown.

        1 - VerySafe: Long history of good behavior.

        2 - Safe: Consistently good behavior.

        3 - ProbablySafe: Reasonable history of good behavior.

        4 - LeansSafe: Starting to establish a history of normal behavior.

        5 - MaynotbeSafe: No established history of normal behavior.

        6 - ExerciseCaution: Starting to establish a history of suspicious or
        risky behavior.

        7 - Risky: A site with a history of suspicious or risky behavior. (spam,
        scam, potentially unwanted software, potentially malicious).

        8 - PossiblyMalicious: Strong possibility of maliciousness.

        9 - ProbablyMalicious: Indicators of maliciousness.

        10 - Malicious: Proven evidence of maliciousness.

        99 - Other: The reputation score is not mapped. See the
        <code>rep_score</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityRequest:
      title: ocsfv1.6.0httpactivityRequest
      type: object
      description: The Request Elements object describes characteristics of an API request.
      properties:
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api request.
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api request.
        uid:
          type: string
          description: The unique request identifier.
      required:
        - uid
    ocsfv1.6.0httpactivityResponse:
      title: ocsfv1.6.0httpactivityResponse
      type: object
      description: >-
        The Response Elements object describes characteristics of an API
        response.
      properties:
        code:
          type: integer
          nullable: true
          description: The numeric response sent to a request.
        containers:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityContainer'
          nullable: true
          description: >-
            When working with containerized applications, the set of containers
            which write to the standard the output of a particular logging
            driver. For example, this may be the set of containers involved in
            handling api requests and responses for a containerized application.
        data:
          nullable: true
          description: The additional data that is associated with the api response.
        error:
          type: string
          nullable: true
          description: Error Code
        error_message:
          type: string
          nullable: true
          description: Error Message
        flags:
          type: array
          items:
            type: string
          nullable: true
          description: The communication flags that are associated with the api response.
        message:
          type: string
          nullable: true
          description: The description of the event/finding, as defined by the source.
    ocsfv1.6.0httpactivityRule:
      title: ocsfv1.6.0httpactivityRule
      type: object
      description: >-
        The Rule object describes characteristics of a rule associated with a
        policy or an event.
      properties:
        category:
          type: string
          nullable: true
          description: The rule category.
        desc:
          type: string
          nullable: true
          description: The description of the rule that generated the event.
        name:
          type: string
          nullable: true
          description: The name of the rule that generated the event.
        type:
          type: string
          nullable: true
          description: The rule type.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the rule that generated the event.
        version:
          type: string
          nullable: true
          description: 'The rule version. For example: <code>1.1</code>.'
    ocsfv1.6.0httpactivitySan:
      title: ocsfv1.6.0httpactivitySan
      type: object
      description: >-
        The Subject Alternative name (SAN) object describes a SAN secured by a
        digital certificate
      properties:
        name:
          type: string
          description: Name of SAN (e.g. The actual IP Address or domain.)
        type:
          type: string
          description: Type descriptor of SAN (e.g. IP Address/domain/etc.)
      required:
        - name
        - type
    ocsfv1.6.0httpactivityScim:
      title: ocsfv1.6.0httpactivityScim
      type: object
      description: >-
        The System for Cross-domain Identity Management (SCIM) Configuration
        object provides a structured set of attributes related to SCIM protocols
        used for identity provisioning and management across cloud-based
        platforms. It standardizes user and group provisioning details, enabling
        identity synchronization and lifecycle management with compatible
        Identity Providers (IdPs) and applications. SCIM is defined in <a
        target="_blank"
        href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityScim_AuthProtocolId'
          nullable: true
          description: >-
            The normalized identifier of the authorization protocol used by the
            SCIM resource.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: When the SCIM resource was added to the service provider.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SCIM resource was added to the service provider.
        error_message:
          type: string
          nullable: true
          description: Message or code associated with the last encountered error.
        is_group_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            groups, automatically or otherwise.
        is_user_provisioning_enabled:
          type: boolean
          nullable: true
          description: >-
            Indicates whether the SCIM resource is configured to provision
            users, automatically or otherwise.
        last_run_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        last_run_time_dt:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the most recent successful synchronization.
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: >-
            The most recent time when the SCIM resource was updated at the
            service provider.
        name:
          type: string
          nullable: true
          description: The name of the SCIM resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SCIM resource. E.g.,
            <code>SAML</code>, <code>OIDC</code>, or <code>OAuth2</code>.
        rate_limit:
          type: integer
          nullable: true
          description: >-
            Maximum number of requests allowed by the SCIM resource within a
            specified time frame to avoid throttling.
        scim_group_schema:
          nullable: true
          description: >-
            SCIM provides a schema for representing groups, identified using the
            following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:Group</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            This attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource.
        scim_user_schema:
          nullable: true
          description: >-
            SCIM provides a resource type for user resources. The core schema
            for user is identified using the following schema URI:
            <code>urn:ietf:params:scim:schemas:core:2.0:User</code> as defined
            in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc7643">RFC-7634</a>.
            his attribute will capture key-value pairs for the scheme
            implemented in a SCIM resource. This object is inclusive of both the
            basic and Enterprise User Schema Extension.
        state:
          type: string
          nullable: true
          description: >-
            The provisioning state of the SCIM resource, normalized to the
            caption of the <code>state_id</code> value. In the case of
            <code>Other</code>, it is defined by the event source.
        state_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityScim_StateId'
          nullable: true
          description: >-
            The normalized state ID of the SCIM resource to reflect its
            activation status.
        uid:
          type: string
          nullable: true
          description: >-
            A unique identifier for a SCIM resource as defined by the service
            provider.
        uid_alt:
          type: string
          nullable: true
          description: >-
            A String that is an identifier for the resource as defined by the
            provisioning client. The <code>externalId</code> may simplify
            identification of a resource between the provisioning client and the
            service provider by allowing the client to use a filter to locate
            the resource with an identifier from the provisioning domain,
            obviating the need to store a local mapping between the provisioning
            domain's identifier of the resource and the identifier used by the
            service provider.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: The primary URL for SCIM API requests.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SCIM. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
        version:
          type: string
          nullable: true
          description: SCIM protocol version supported e.g., <code>SCIM 2.0</code>.
    ocsfv1.6.0httpactivityScim_AuthProtocolId:
      title: ocsfv1.6.0httpactivityScim_AuthProtocolId
      type: integer
      description: >-
        ScimAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityScim_StateId:
      title: ocsfv1.6.0httpactivityScim_StateId
      type: integer
      description: >-
        ScimStateId is an enum, and the following values are allowed.

        0 - Unknown: The provisioning state of the SCIM resource is unknown.

        1 - Pending: The SCIM resource is Pending activation or creation.

        2 - Active: The SCIM resource is in an Active state, or otherwise
        enabled.

        3 - Failed: The SCIM resource is in a Failed state.

        4 - Deleted: The SCIM resource is in a Deleted state, or otherwise
        disabled.

        99 - Other: The provisioning state of the SCIM resource is not mapped.
        See the <code>state</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityScript:
      title: ocsfv1.6.0httpactivityScript
      type: object
      description: >-
        The Script object describes a script or command that can be executed by
        a shell, script engine, or interpreter. Examples include Bash,
        JavsScript, PowerShell, Python, VBScript, etc. Note that the term
        <em>script</em> here denotes not only a script contained within a file
        but also a script or command typed interactively by a user, supplied on
        the command line, or provided by some other file-less mechanism.
      properties:
        file:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFile'
          nullable: true
          description: >-
            Present if this script is associated with a file. Not present in the
            case of a file-less script.
        hashes:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: >-
            An array of the script's cryptographic hashes. Note that these
            hashes are calculated on the script in its original encoding, and
            not on the normalized UTF-8 encoding found in the
            <code>script_content</code> attribute.
        name:
          type: string
          nullable: true
          description: >-
            Unique identifier for the script or macro, independent of the
            containing file, used for tracking, auditing, and security analysis.
        parent_uid:
          type: string
          nullable: true
          description: >-
            This attribute relates a sub-script to a parent script having the
            matching <code>uid</code> attribute. In the case of PowerShell,
            sub-script execution can be identified by matching the activity
            correlation ID of the raw ETW events provided by the OS.
        script_content:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLongString'
          description: >-
            The script content, normalized to UTF-8 encoding irrespective of its
            original encoding. When emitting this attribute, it may be
            appropriate to truncate large scripts. When consuming this
            attribute, large scripts should be anticipated.
        type:
          type: string
          nullable: true
          description: >-
            The script type, normalized to the caption of the
            <code>type_id</code> value. In the case of 'Other', it is defined by
            the event source.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityScript_TypeId'
          description: The normalized script type ID.
        uid:
          type: string
          nullable: true
          description: >-
            Some script engines assign a unique ID to each individual execution
            of a given script. This attribute captures that unique ID. In the
            case of PowerShell, the unique ID corresponds to the
            <code>ScriptBlockId</code> in the raw ETW events provided by the OS.
      required:
        - script_content
        - type_id
    ocsfv1.6.0httpactivityScript_TypeId:
      title: ocsfv1.6.0httpactivityScript_TypeId
      type: integer
      description: >-
        ScriptTypeId is an enum, and the following values are allowed.

        0 - Unknown: The script type is unknown.

        1 - WindowsCommandPrompt

        2 - PowerShell

        3 - Python

        4 - JavaScript

        5 - VBScript

        6 - UnixShell

        7 - VBA

        99 - Other: The script type is not mapped. See the <code>type</code>
        attribute which contains an event source specific value.
    ocsfv1.6.0httpactivityService:
      title: ocsfv1.6.0httpactivityService
      type: object
      description: >-
        The Service object describes characteristics of a service, <code> e.g.
        AWS EC2. </code>
      properties:
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: The list of labels associated with the service.
        name:
          type: string
          nullable: true
          description: The name of the service.
        tags:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKeyValueObject'
          nullable: true
          description: >-
            The list of tags; <code>{key:value}</code> pairs associated to the
            service.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the service.
        version:
          type: string
          nullable: true
          description: The version of the service.
    ocsfv1.6.0httpactivitySession:
      title: ocsfv1.6.0httpactivitySession
      type: object
      description: >-
        The Session object describes details about an authenticated session.
        e.g. Session Creation Time, Session Issuer.
      properties:
        count:
          type: integer
          nullable: true
          description: >-
            The number of identical sessions spawned from the same source IP,
            destination IP, application, and content/threat type seen over a
            period of time.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the session was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the session was created.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        expiration_reason:
          type: string
          nullable: true
          description: The reason which triggered the session expiration.
        expiration_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The session expiration time.
        expiration_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The session expiration time.
        is_mfa:
          type: boolean
          nullable: true
          description: >-
            Indicates whether Multi Factor Authentication was used during
            authentication.
        is_remote:
          type: boolean
          nullable: true
          description: The indication of whether the session is remote.
        is_vpn:
          type: boolean
          nullable: true
          description: The indication of whether the session is a VPN session.
        issuer:
          type: string
          nullable: true
          description: The identifier of the session issuer.
        terminal:
          type: string
          nullable: true
          description: >-
            The Pseudo Terminal associated with the session. Ex: the tty or pts
            value.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the session.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate unique identifier of the session. e.g. AWS ARN -
            <code>arn:aws:sts::123344444444:assumed-role/Admin/example-session</code>.
        uuid:
          type: string
          nullable: true
          description: The universally unique identifier of the session.
    ocsfv1.6.0httpactivitySso:
      title: ocsfv1.6.0httpactivitySso
      type: object
      description: >-
        The Single Sign-On (SSO) object provides a structure for normalizing SSO
        attributes, configuration, and/or settings from Identity Providers.
      properties:
        auth_protocol:
          type: string
          nullable: true
          description: >-
            The authorization protocol as defined by the caption of
            <code>auth_protocol_id</code>. In the case of <code>Other</code>, it
            is defined by the event source.
        auth_protocol_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySso_AuthProtocolId'
          nullable: true
          description: >-
            The normalized identifier of the authentication protocol used by the
            SSO resource.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCertificate'
          nullable: true
          description: >-
            Digital Signature associated with the SSO resource, e.g., SAML X.509
            certificate details.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: When the SSO resource was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the SSO resource was created.
        duration_mins:
          type: integer
          nullable: true
          description: >-
            The duration (in minutes) for an SSO session, after which
            re-authentication is required.
        idle_timeout:
          type: integer
          nullable: true
          description: >-
            Duration (in minutes) of allowed inactivity before Single Sign-On
            (SSO) session expiration.
        login_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: URL for initiating an SSO login request.
        logout_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            URL for initiating an SSO logout request, allowing sessions to be
            terminated across applications.
        metadata_endpoint:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            URL where metadata about the SSO configuration is available (e.g.,
            for SAML configurations).
        modified_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The most recent time when the SSO resource was updated.
        modified_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The most recent time when the SSO resource was updated.
        name:
          type: string
          nullable: true
          description: The name of the SSO resource.
        protocol_name:
          type: string
          nullable: true
          description: >-
            The supported protocol for the SSO resource. E.g., <code>SAML</code>
            or <code>OIDC</code>.
        scopes:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Scopes define the specific permissions or actions that the client is
            allowed to perform on behalf of the user. Each scope represents a
            different set of permissions, and the user can selectively grant or
            deny access to specific scopes during the authorization process.
        uid:
          type: string
          nullable: true
          description: A unique identifier for a SSO resource.
        vendor_name:
          type: string
          nullable: true
          description: >-
            Name of the vendor or service provider implementing SSO. E.g.,
            <code>Okta</code>, <code>Auth0</code>, <code>Microsoft</code>.
    ocsfv1.6.0httpactivitySso_AuthProtocolId:
      title: ocsfv1.6.0httpactivitySso_AuthProtocolId
      type: integer
      description: >-
        SsoAuthProtocolId is an enum, and the following values are allowed.

        0 - Unknown: The authentication protocol is unknown.

        1 - NTLM

        2 - Kerberos

        3 - Digest

        4 - OpenID

        5 - SAML

        6 - 0

        7 - PAP

        8 - CHAP

        9 - EAP

        10 - RADIUS

        11 - BasicAuthentication

        12 - LDAP

        99 - Other: The authentication protocol is not mapped. See the
        <code>auth_protocol</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivitySubTechnique:
      title: ocsfv1.6.0httpactivitySubTechnique
      type: object
      description: >-
        The MITRE Sub-technique object describes the ATT&amp;CK® or ATLAS™
        Sub-technique ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack sub-technique. For example: <code>Scanning IP
            Blocks</code> or <code>User Execution: Unsafe ML Artifacts</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack sub-technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/001/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack sub-technique. For example:
            <code>T1595.001</code> or <code>AML.T0011.000</code>.
    ocsfv1.6.0httpactivityTactic:
      title: ocsfv1.6.0httpactivityTactic
      type: object
      description: >-
        The MITRE Tactic object describes the ATT&amp;CK® or ATLAS™ Tactic ID
        and/or name that is associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The Tactic name that is associated with the attack technique. For
            example: <code>Reconnaissance</code> or <code>ML Model
            Access</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the Tactic. For example:
            <code>https://attack.mitre.org/versions/v14/tactics/TA0043/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The Tactic ID that is associated with the attack technique. For
            example: <code>TA0043</code>, or <code>AML.TA0000</code>.
    ocsfv1.6.0httpactivityTechnique:
      title: ocsfv1.6.0httpactivityTechnique
      type: object
      description: >-
        The MITRE Technique object describes the ATT&amp;CK® or ATLAS™ Technique
        ID and/or name associated to an attack.
      properties:
        name:
          type: string
          nullable: true
          description: >-
            The name of the attack technique. For example: <code>Active
            Scanning</code> or <code>AI Model Inference API Access</code>.
        src_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The versioned permalink of the attack technique. For example:
            <code>https://attack.mitre.org/versions/v14/techniques/T1595/</code>.
        uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the attack technique. For example:
            <code>T1595</code> or <code>AML.T0040</code>.
    ocsfv1.6.0httpactivityThreatActor:
      title: ocsfv1.6.0httpactivityThreatActor
      type: object
      description: Threat actor is responsible for the observed malicious activity.
      properties:
        name:
          type: string
          description: The name of the threat actor.
        type:
          type: string
          nullable: true
          description: >-
            The classification of the threat actor based on their motivations,
            capabilities, or affiliations. Common types include nation-state
            actors, cybercriminal groups, hacktivists, or insider threats.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityThreatActor_TypeId'
          nullable: true
          description: The normalized datastore resource type identifier.
      required:
        - name
    ocsfv1.6.0httpactivityThreatActor_TypeId:
      title: ocsfv1.6.0httpactivityThreatActor_TypeId
      type: integer
      description: |-
        ThreatActorTypeId is an enum, and the following values are allowed.
        0 - Unknown: The threat actor type is unknown.
        1 - state
        2 - Cybercriminal
        3 - Hacktivists
        4 - Insider
        99 - Other: The threat actor type is not mapped.
    ocsfv1.6.0httpactivityTimespan:
      title: ocsfv1.6.0httpactivityTimespan
      type: object
      description: >-
        The Time Span object represents different time period durations. If a
        timespan is fractional, i.e. crosses one period, e.g. a week and 3 days,
        more than one may be populated since each member is of integral type. In
        that case <code>type_id</code> if present should be set to
        <code>Other.</code><p>A timespan may also be defined by its time
        interval boundaries, <code>start_time</code> and
        <code>end_time</code>.</p>
      properties:
        duration:
          type: integer
          nullable: true
          description: The duration of the time span in milliseconds.
        duration_days:
          type: integer
          nullable: true
          description: The duration of the time span in days.
        duration_hours:
          type: integer
          nullable: true
          description: The duration of the time span in hours.
        duration_mins:
          type: integer
          nullable: true
          description: The duration of the time span in minutes.
        duration_months:
          type: integer
          nullable: true
          description: The duration of the time span in months.
        duration_secs:
          type: integer
          nullable: true
          description: The duration of the time span in seconds.
        duration_weeks:
          type: integer
          nullable: true
          description: The duration of the time span in weeks.
        duration_years:
          type: integer
          nullable: true
          description: The duration of the time span in years.
        end_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        end_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The end time or conclusion of the timespan's interval.
        start_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The start time or beginning of the timespan's interval.
        start_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The start time or beginning of the timespan's interval.
        type:
          type: string
          nullable: true
          description: The type of time span duration the object represents.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimespan_TypeId'
          nullable: true
          description: The normalized identifier for the time span duration type.
    ocsfv1.6.0httpactivityTimespan_TypeId:
      title: ocsfv1.6.0httpactivityTimespan_TypeId
      type: integer
      description: >-
        TimespanTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - Milliseconds

        2 - Seconds

        3 - Minutes

        4 - Hours

        5 - Days

        6 - Weeks

        7 - Months

        8 - Years

        9 - TimeInterval: The <code>start_time</code> and <code>end_time</code>
        should be set.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityTls:
      title: ocsfv1.6.0httpactivityTls
      type: object
      description: >-
        The Transport Layer Security (TLS) object describes the negotiated TLS
        protocol used for secure communications over an establish network
        connection.
      properties:
        alert:
          type: integer
          nullable: true
          description: >-
            The integer value of TLS alert if present. The alerts are defined in
            the TLS specification in <a target="_blank"
            href="https://datatracker.ietf.org/doc/html/rfc2246">RFC-2246</a>.
        certificate:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCertificate'
          nullable: true
          description: >-
            The certificate object containing information about the digital
            certificate.
        certificate_chain:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Chain of Certificate Serial Numbers field provides a chain of
            Certificate Issuer Serial Numbers leading to the Root Certificate
            Issuer.
        cipher:
          type: string
          nullable: true
          description: The negotiated cipher suite.
        client_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The client cipher suites that were exchanged during the TLS
            handshake negotiation.
        extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        handshake_dur:
          type: integer
          nullable: true
          description: >-
            The amount of total time for the TLS handshake to complete after the
            TCP connection is established, including client-side delays, in
            milliseconds.
        ja3_hash:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3 string.
        ja3s_hash:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityFingerprint'
          nullable: true
          description: The MD5 hash of a JA3S string.
        key_length:
          type: integer
          nullable: true
          description: The length of the encryption key.
        sans:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivitySan'
          nullable: true
          description: >-
            The list of subject alternative names that are secured by a specific
            certificate.
        server_ciphers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The server cipher suites that were exchanged during the TLS
            handshake negotiation.
        sni:
          type: string
          nullable: true
          description: The Server Name Indication (SNI) extension sent by the client.
        tls_extension_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityTlsExtension'
          nullable: true
          description: The list of TLS extensions.
        version:
          type: string
          description: The TLS protocol version.
      required:
        - version
    ocsfv1.6.0httpactivityTlsExtension:
      title: ocsfv1.6.0httpactivityTlsExtension
      type: object
      description: >-
        The TLS Extension object describes additional attributes that extend the
        base Transport Layer Security (TLS) object.
      properties:
        data:
          nullable: true
          description: >-
            The data contains information specific to the particular extension
            type.
        type:
          type: string
          nullable: true
          description: 'The TLS extension type. For example: <code>Server Name</code>.'
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTlsExtension_TypeId'
          description: >-
            The TLS extension type identifier. See <a target='_blank'
            href='https://datatracker.ietf.org/doc/html/rfc8446#page-35'>The
            Transport Layer Security (TLS) extension page</a>.
      required:
        - type_id
    ocsfv1.6.0httpactivityTlsExtension_TypeId:
      title: ocsfv1.6.0httpactivityTlsExtension_TypeId
      type: integer
      description: >-
        TlsExtensionTypeId is an enum, and the following values are allowed.

        0 - name: The Server Name Indication extension.

        1 - fragment_length: The Maximum Fragment Length Negotiation extension.

        5 - request: The Certificate Status Request extension.

        10 - groups: The Supported Groups extension.

        13 - algorithms: The Signature Algorithms extension.

        14 - srtp: The Use SRTP data protection extension.

        15 - heartbeat: The Heartbeat extension.

        16 - layer_protocol_negotiation: The Application-Layer Protocol
        Negotiation extension.

        18 - certificate_timestamp: The Signed Certificate Timestamp extension.

        19 - certificate_type: The Client Certificate Type extension.

        20 - certificate_type: The Server Certificate Type extension.

        21 - padding: The Padding extension.

        41 - shared_key: The Pre Shared Key extension.

        42 - data: The Early Data extension.

        43 - versions: The Supported Versions extension.

        44 - cookie: The Cookie extension.

        45 - key_exchange_modes: The Pre-Shared Key Exchange Modes extension.

        47 - authorities: The Certificate Authorities extension.

        48 - filters: The OID Filters extension.

        49 - handshake_auth: The Post-Handshake Client Authentication extension.

        50 - algorithms_cert: The Signature Algorithms extension.

        51 - share: The Key Share extension.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityTransformationInfo:
      title: ocsfv1.6.0httpactivityTransformationInfo
      type: object
      description: >-
        The transformation_info object represents the mapping or transformation
        used.
      properties:
        lang:
          type: string
          nullable: true
          description: The transformation language used to transform the data.
        name:
          type: string
          nullable: true
          description: The name of the transformation or mapping.
        product:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityProduct'
          nullable: true
          description: The product or instance used to make the transformation
        time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: Time of the transformation.
        time_dt:
          type: string
          format: date-time
          nullable: true
          description: Time of the transformation.
        uid:
          type: string
          nullable: true
          description: The unique identifier of the mapping or transformation.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The Uniform Resource Locator String where the mapping or
            transformation exists.
    ocsfv1.6.0httpactivityUrl:
      title: ocsfv1.6.0httpactivityUrl
      type: object
      description: >-
        The Uniform Resource Locator (URL) object describes the characteristics
        of a URL.
      properties:
        categories:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The Website categorization names, as defined by
            <code>category_ids</code> enum values.
        category_ids:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityUrl_CategoryIds'
          nullable: true
          description: The Website categorization identifiers.
        domain:
          type: string
          nullable: true
          description: >-
            The domain portion of the URL. For example: <code>example.com</code>
            in <code>https://sub.example.com</code>.
        hostname:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityHostname'
          nullable: true
          description: >-
            The URL host as extracted from the URL. For example:
            <code>www.example.com</code> from
            <code>www.example.com/download/trouble</code>.
        path:
          type: string
          nullable: true
          description: >-
            The URL path as extracted from the URL. For example:
            <code>/download/trouble</code> from
            <code>www.example.com/download/trouble</code>.
        port:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityPort'
          nullable: true
          description: 'The URL port. For example: <code>80</code>.'
        query_string:
          type: string
          nullable: true
          description: >-
            The query portion of the URL. For example: the query portion of the
            URL <code>http://www.example.com/search?q=bad&amp;sort=date</code>
            is <code>q=bad&amp;sort=date</code>.
        resource_type:
          type: string
          nullable: true
          description: The context in which a resource was retrieved in a web request.
        scheme:
          type: string
          nullable: true
          description: >-
            The scheme portion of the URL. For example: <code>http</code>,
            <code>https</code>, <code>ftp</code>, or <code>sftp</code>.
        subdomain:
          type: string
          nullable: true
          description: >-
            The subdomain portion of the URL. For example: <code>sub</code> in
            <code>https://sub.example.com</code> or <code>sub2.sub1</code> in
            <code>https://sub2.sub1.example.com</code>.
        url_string:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: >-
            The URL string. See RFC 1738. For example:
            <code>http://www.example.com/download/trouble.exe</code>. Note: The
            URL path should not populate the URL string.
    ocsfv1.6.0httpactivityUrl_CategoryIds:
      title: ocsfv1.6.0httpactivityUrl_CategoryIds
      type: integer
      description: >-
        UrlCategoryIds is an enum, and the following values are allowed.

        0 - Unknown: The Domain/URL category is unknown.

        1 - MatureContent

        3 - Pornography

        4 - SexEducation

        5 - Swimsuit

        6 - Nudity

        7 - Extreme

        9 - Questionable*Illegal

        11 - Gambling

        14 - Hate_Racism

        15 - Weapons

        16 - Abortion

        17 - Hacking

        18 - Phishing

        20 - Entertainment

        21 - Economy

        22 - Belief

        23 - Alcohol

        24 - Tobacco

        25 - ControlledSubstances

        26 - ChildPornography

        27 - Education

        29 - CharitableOrganizations

        30 - Culture

        31 - FinancialServices

        32 - Trading

        33 - Games

        34 - Legal

        35 - Military

        36 - SocialAdvocacy

        37 - Health

        38 - Internet

        40 - Portals

        43 - Malnets

        44 - Botnets

        45 - Careers

        46 - Media

        47 - Dating

        49 - Reference

        50 - PotentiallyAdult

        51 - IM_SMS

        52 - Email

        53 - Forums

        54 - Religion

        55 - SocialNetworking

        56 - Sharing

        57 - RemoteAccessTools

        58 - Shopping

        59 - Auctions

        60 - RealEstate

        61 - DailyLiving

        63 - PersonalSites

        64 - Dining_Food

        65 - Recreation

        66 - Travel

        67 - Vehicles

        68 - Jokes

        71 - SoftwareDownloads

        83 - to_Peer_P2P*

        84 - VideoClips

        85 - BusinessApplications

        86 - ProxyAvoidance

        87 - ForKids

        88 - Analytics

        89 - WebHosting

        90 - Uncategorized

        92 - Suspicious

        93 - SexualExpression

        95 - Translation

        96 - Viewable_Infrastructure

        97 - ContentServers

        98 - Placeholders

        99 - Other: The Domain/URL category is not mapped. See the
        <code>categories</code> attribute, which contains a data source specific
        value.

        101 - Spam

        102 - PotentiallyUnwantedSoftware

        103 - DynamicDNSHost

        106 - Card_Invitations

        107 - Informational

        108 - InformationSecurity

        109 - InternetConnectedDevices

        110 - InternetTelephony

        111 - OnlineMeetings

        112 - MediaSharing

        113 - AudioStreams

        114 - VideoStreams

        118 - CopyrightConcerns

        121 - Marijuana
    ocsfv1.6.0httpactivityUser:
      title: ocsfv1.6.0httpactivityUser
      type: object
      description: >-
        The User object describes the characteristics of a user/person or a
        security principal.
      properties:
        account:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAccount'
          nullable: true
          description: The user's account or the account associated with the user.
        credential_uid:
          type: string
          nullable: true
          description: >-
            The unique identifier of the user's credential. For example, AWS
            Access Key ID.
        display_name:
          type: string
          nullable: true
          description: The display name of the user, as reported by the product.
        domain:
          type: string
          nullable: true
          description: >-
            The domain where the user is defined. For example: the LDAP or
            Active Directory domain.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The user's primary email address.
        forward_addr:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The user's forwarding email address.
        full_name:
          type: string
          nullable: true
          description: The full name of the user, as reported by the product.
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityGroup'
          nullable: true
          description: The administrative groups to which the user belongs.
        has_mfa:
          type: boolean
          nullable: true
          description: The user has a multi-factor or secondary-factor device assigned.
        ldap_person:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityLdapPerson'
          nullable: true
          description: The additional LDAP attributes that describe a person.
        mfa_status:
          type: string
          nullable: true
          description: >-
            The multi-factor authentication status, normalized to the caption of
            the mfa_status_id value. In the case of 'Other', it is defined by
            the data source.
        mfa_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser_MfaStatusId'
          nullable: true
          description: >-
            The normalized identifier of the user's multi-factor authentication
            status.
        name:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUserName'
          nullable: true
          description: The username. For example, <code>janedoe1</code>.
        org:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityOrganization'
          nullable: true
          description: Organization and org unit related to the user.
        phone_number:
          type: string
          nullable: true
          description: The telephone number of the user.
        privileges:
          type: array
          items:
            type: string
          nullable: true
          description: The user's privileges.
        programmatic_credentials:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityProgrammaticCredential'
          nullable: true
          description: >-
            Details about the programmatic credential (API keys, access tokens,
            certificates, etc) associated to the user.
        risk_level:
          type: string
          nullable: true
          description: >-
            The risk level, normalized to the caption of the risk_level_id
            value.
        risk_level_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser_RiskLevelId'
          nullable: true
          description: The normalized risk level id.
        risk_score:
          type: integer
          nullable: true
          description: The risk score as reported by the event source.
        type:
          type: string
          nullable: true
          description: The type of the user. For example, System, AWS IAM User, etc.
        type_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser_TypeId'
          nullable: true
          description: The account type identifier.
        uid:
          type: string
          nullable: true
          description: >-
            The unique user identifier. For example, the Windows user SID,
            ActiveDirectory DN or AWS user ARN.
        uid_alt:
          type: string
          nullable: true
          description: >-
            The alternate user identifier. For example, the Active Directory
            user GUID or AWS user Principal ID.
        user_status:
          type: string
          nullable: true
          description: >-
            The user status, normalized to the caption of the user_status_id
            value. In the case of 'Other', it is defined by the data source.
        user_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityUser_UserStatusId'
          nullable: true
          description: The normalized identifier of the user's status.
    ocsfv1.6.0httpactivityUser_MfaStatusId:
      title: ocsfv1.6.0httpactivityUser_MfaStatusId
      type: integer
      description: >-
        UserMfaStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Enabled: Multi-factor authentication is enabled for this user.

        2 - NotEnabled: TMulti-factor authentication is off for this user.

        3 - Enforced: Multi-factor authentication is enabled and there is a
        policy that requires it for this user.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityUser_RiskLevelId:
      title: ocsfv1.6.0httpactivityUser_RiskLevelId
      type: integer
      description: >-
        UserRiskLevelId is an enum, and the following values are allowed.

        0 - Info

        1 - Low

        2 - Medium

        3 - High

        4 - Critical

        99 - Other: The risk level is not mapped. See the
        <code>risk_level</code> attribute, which contains a data source specific
        value.
    ocsfv1.6.0httpactivityUser_TypeId:
      title: ocsfv1.6.0httpactivityUser_TypeId
      type: integer
      description: >-
        UserTypeId is an enum, and the following values are allowed.

        0 - Unknown: The type is unknown.

        1 - User: Regular user account.

        2 - Admin: Admin/root user account.

        3 - System: System account. For example, Windows computer accounts with
        a trailing dollar sign ($).

        4 - Service: Service account. For example, Windows service account.

        99 - Other: The type is not mapped. See the <code>type</code> attribute,
        which contains a data source specific value.
    ocsfv1.6.0httpactivityUser_UserStatusId:
      title: ocsfv1.6.0httpactivityUser_UserStatusId
      type: integer
      description: >-
        UserUserStatusId is an enum, and the following values are allowed.

        0 - Unknown: The status is unknown.

        1 - Active: The user is active.

        2 - Pending: The user is not active, pending either user or admin
        action.

        3 - Locked: The user account is locked requiring either time or
        intervention to unlock.

        4 - Suspended: The user account is suspended.

        5 - Deprovisioned: The user account has been deprovisioned and is
        pending removal.

        99 - Other: The event status is not mapped. See the
        <code>user_status</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityVulnerability:
      title: ocsfv1.6.0httpactivityVulnerability
      type: object
      description: >-
        The vulnerability is an unintended characteristic of a computing
        component or system configuration that multiplies the risk of an adverse
        event or a loss occurring either due to accidental exposure, deliberate
        attack, or conflict with new system components.
      properties:
        advisory:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAdvisory'
          nullable: true
          description: >-
            Detail about the security advisory, that is used to publicly
            disclose cybersecurity vulnerabilities by a vendor.
        affected_code:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAffectedCode'
          nullable: true
          description: >-
            List of Affected Code objects that describe details about code
            blocks identified as vulnerable.
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityAffectedPackage'
          nullable: true
          description: >-
            List of software packages identified as affected by a
            vulnerability/vulnerabilities.
        category:
          type: string
          nullable: true
          description: >-
            The category of a vulnerability or weakness, as reported by the
            source tool, such as <code>Container Security</code> or <code>Open
            Source Security</code>.
        cve:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCve'
          nullable: true
          description: >-
            Describes the Common Vulnerabilities and Exposures <a
            target='_blank' href='https://cve.mitre.org/'>(CVE)</a> details
            related to the vulnerability.
        cwe:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityCwe'
          nullable: true
          description: >-
            Describes the Common Weakness Enumeration <a target='_blank'
            href='https://cwe.mitre.org/'>(CWE)</a> details related to the
            vulnerability.
        dependency_chain:
          type: string
          nullable: true
          description: >-
            Information about the chain of dependencies related to the issue as
            reported by an Application Security or Vulnerability Management
            tool. E.g., <code>serverless-offline -&gt; @serverless/utils -&gt;
            memoizee -&gt; es5-ext</code>.
        desc:
          type: string
          nullable: true
          description: The description of the vulnerability.
        exploit_last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the exploit was most recently observed.
        exploit_ref_url:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityURLString'
          nullable: true
          description: The URL of the exploit code or Proof-of-Concept (PoC).
        exploit_requirement:
          type: string
          nullable: true
          description: >-
            The requirement description related to any constraints around
            exploit execution.
        exploit_type:
          type: string
          nullable: true
          description: >-
            The categorization or type of Exploit. E.g., <code>Network</code> or
            <code>Physical</code>.
        first_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was first observed.
        first_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was first observed.
        fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        fix_coverage:
          type: string
          nullable: true
          description: >-
            The fix coverage, normalized to the caption of the
            <code>fix_coverage_id</code> value.
        fix_coverage_id:
          $ref: >-
            #/components/schemas/ocsfv1.6.0httpactivityVulnerability_FixCoverageId
          nullable: true
          description: >-
            The normalized identifier for fix coverage, applicable to this
            vulnerability. Typically useful, when there are multiple affected
            packages but only a subset have available fixes.
        is_exploit_available:
          type: boolean
          nullable: true
          description: >-
            Indicates if an exploit or a PoC (proof-of-concept) is available for
            the reported vulnerability.
        is_fix_available:
          type: boolean
          nullable: true
          description: Indicates if a fix is available for the reported vulnerability.
        kb_article_list:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityKbArticle'
          nullable: true
          description: >-
            A list of KB articles or patches related to an endpoint. A KB
            Article contains metadata that describes the patch or an update.
        kb_articles:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The KB article/s related to the entity. A KB Article contains
            metadata that describes the patch or an update.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: The time when the vulnerability was most recently observed.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: The time when the vulnerability was most recently observed.
        packages:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityPackage'
          nullable: true
          description: List of vulnerable packages as identified by the security product
        references:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A list of reference URLs with additional information about the
            vulnerability.
        related_vulnerabilities:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            List of vulnerability IDs (e.g. CVE ID) that are related to this
            vulnerability.
        remediation:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityRemediation'
          nullable: true
          description: >-
            The remediation recommendations on how to mitigate the identified
            vulnerability.
        severity:
          type: string
          nullable: true
          description: The vendor assigned severity of the vulnerability.
        title:
          type: string
          nullable: true
          description: A title or a brief phrase summarizing the discovered vulnerability.
        vendor_name:
          type: string
          nullable: true
          description: The name of the vendor that identified the vulnerability.
    ocsfv1.6.0httpactivityVulnerability_FixCoverageId:
      title: ocsfv1.6.0httpactivityVulnerability_FixCoverageId
      type: integer
      description: >-
        VulnerabilityFixCoverageId is an enum, and the following values are
        allowed.

        0 - Unknown: The fix coverage is unknown.

        1 - Complete: All affected packages and components have available fixes
        or patches to remediate the vulnerability.

        2 - Partial: Only some of the affected packages and components have
        available fixes or patches, while others remain vulnerable.

        3 - None: No fixes or patches are currently available for any of the
        affected packages and components.

        99 - Other: The fix coverage is not mapped. See the
        <code>fix_coverage</code> attribute, which contains a data source
        specific value.
    ocsfv1.6.0httpactivityWhois:
      title: ocsfv1.6.0httpactivityWhois
      type: object
      description: >-
        The resources of a WHOIS record for a given domain. This can include
        domain names, IP address blocks, autonomous system information, and/or
        contact and registration information for a domain.
      properties:
        autonomous_system:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityAutonomousSystem'
          nullable: true
          description: The autonomous system information associated with a domain.
        created_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        created_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the domain was registered or WHOIS entry was created.
        dnssec_status:
          type: string
          nullable: true
          description: The normalized value of dnssec_status_id.
        dnssec_status_id:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityWhois_DnssecStatusId'
          nullable: true
          description: >-
            Describes the normalized status of DNS Security Extensions (DNSSEC)
            for a domain.
        domain:
          type: string
          nullable: true
          description: The domain name corresponding to the WHOIS record.
        domain_contacts:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.6.0httpactivityDomainContact'
          nullable: true
          description: An array of <code>Domain Contact</code> objects.
        email_addr:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityEmailAddress'
          nullable: true
          description: The email address for the registrar's abuse contact
        isp:
          type: string
          nullable: true
          description: The name of the Internet Service Provider (ISP).
        isp_org:
          type: string
          nullable: true
          description: >-
            The organization name of the Internet Service Provider (ISP). This
            represents the parent organization or company that owns/operates the
            ISP. For example, Comcast Corporation would be the ISP org for
            Xfinity internet service. This attribute helps identify the ultimate
            provider when ISPs operate under different brand names.
        last_seen_time:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivityTimestamp'
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        last_seen_time_dt:
          type: string
          format: date-time
          nullable: true
          description: When the WHOIS record was last updated or seen at.
        name_servers:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            A collection of name servers related to a domain registration or
            other record.
        phone_number:
          type: string
          nullable: true
          description: The phone number for the registrar's abuse contact
        registrar:
          type: string
          nullable: true
          description: The domain registrar.
        status:
          type: string
          nullable: true
          description: >-
            The status of a domain and its ability to be transferred, e.g.,
            <code>clientTransferProhibited</code>.
        subdomains:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            An array of subdomain strings. Can be used to collect several
            subdomains such as those from Domain Generation Algorithms (DGAs).
        subnet:
          $ref: '#/components/schemas/ocsfv1.6.0httpactivitySubnet'
          nullable: true
          description: The IP address block (CIDR) associated with a domain.
    ocsfv1.6.0httpactivityWhois_DnssecStatusId:
      title: ocsfv1.6.0httpactivityWhois_DnssecStatusId
      type: integer
      description: >-
        WhoisDnssecStatusId is an enum, and the following values are allowed.

        0 - Unknown: The disposition is unknown.

        1 - Signed: The related domain enables the signing of DNS records using
        DNSSEC.

        2 - Unsigned: The related domain does not enable the signing of DNS
        records using DNSSEC.

        99 - Other: The DNSSEC status is not mapped. See the
        <code>dnssec_status</code> attribute, which contains a data source
        specific value.
    AsyncOperationRequestId:
      title: AsyncOperationRequestId
      $ref: '#/components/schemas/Id'
      description: Unique request identifier for this Asynchronous Operation.
    OperationInput:
      title: OperationInput
      type: object
      properties:
        filters:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Limit the number of results returned by the operation. If not
            specified, the operation will return all results.
        limit:
          type: integer
          nullable: true
          description: Limit query results by these filters.
    Operation:
      title: Operation
      type: object
      properties:
        id:
          $ref: '#/components/schemas/Id'
          description: ID of the operation
        created_at:
          type: string
          format: date-time
          description: Time object was originally created
        updated_at:
          type: string
          format: date-time
          description: Last time object was updated
        account_id:
          $ref: '#/components/schemas/Id'
          description: Account ID containing the integration.
        integration_id:
          $ref: '#/components/schemas/Id'
          description: Integration ID to use for the operation.
        operation:
          type: string
          description: Name of the operation that will be run for this operation.
        input:
          $ref: '#/components/schemas/OperationInput'
          description: Parameters for the operation that will be run for this operation.
        status:
          $ref: '#/components/schemas/OperationStatus'
          description: Status of the operation
        errors:
          type: array
          items:
            $ref: '#/components/schemas/OperationError'
          nullable: true
          description: Errors that occurred during the operation
        cpu_time:
          type: integer
          format: int64
          description: Cpu time in microseconds
        in_bytes:
          type: integer
          format: int64
          description: Total number of bytes sent to the output integration.
        output_integration_id:
          type: string
          nullable: true
          description: ID of the integration receiving operation output.
      required:
        - id
        - created_at
        - updated_at
        - account_id
        - integration_id
        - operation
        - input
        - status
        - cpu_time
        - in_bytes
    OperationStatus:
      title: OperationStatus
      type: string
      enum:
        - SCHEDULED
        - PROCESSING
        - CANCELLED
        - COMPLETE
        - DISABLED
    OperationError:
      title: OperationError
      type: object
      properties:
        message:
          type: string
          description: Error message
      required:
        - message
    OperationId:
      title: OperationId
      type: string
      enum:
        - appsec_get_application_finding_details
        - appsec_query_application_findings
        - appsec_query_applications
        - appsec_query_findings
        - assets_create_asset
        - assets_get_labels
        - assets_query_devices
        - cloudsecurity_query_cloud_resource_inventory
        - cloudsecurity_query_compliance_findings
        - cloudsecurity_query_events
        - cloudsecurity_query_ioms
        - cloudsecurity_query_threats
        - custom_delete
        - custom_get
        - custom_patch
        - custom_post
        - custom_post_batch
        - custom_query
        - edr_create_iocs
        - edr_delete_iocs
        - edr_get_endpoint
        - edr_network_quarantine
        - edr_query_alerts
        - edr_query_applications
        - edr_query_edr_events
        - edr_query_endpoints
        - edr_query_iocs
        - edr_query_posture_score
        - edr_query_threatevents
        - identity_disable_user
        - identity_enable_user
        - identity_expire_all_user_sessions
        - identity_force_user_password_reset
        - identity_get_group
        - identity_get_group_members
        - identity_get_user
        - identity_get_user_picture
        - identity_query_audit_log
        - identity_query_groups
        - identity_query_users
        - incidentresponse_query_escalation_policies
        - incidentresponse_query_escalation_policy_users_on_call
        - notifications_clear_message
        - notifications_create_message
        - notifications_get_message
        - siem_get_alert
        - siem_get_evidence
        - siem_get_investigation
        - siem_patch_investigation
        - siem_post_events
        - siem_query_alerts
        - siem_query_events
        - siem_query_investigations
        - siem_query_log_providers
        - sink_post_events
        - storage_delete_file
        - storage_download_file
        - storage_list_files
        - storage_upload_file
        - ticketing_create_attachment
        - ticketing_create_comment
        - ticketing_create_note
        - ticketing_create_ticket
        - ticketing_delete_attachment
        - ticketing_delete_comment
        - ticketing_delete_note
        - ticketing_download_attachment
        - ticketing_get_ticket
        - ticketing_list_attachments_metadata
        - ticketing_list_comments
        - ticketing_list_notes
        - ticketing_list_on_call
        - ticketing_list_projects
        - ticketing_list_remote_fields
        - ticketing_patch_note
        - ticketing_patch_ticket
        - ticketing_query_escalation_policies
        - ticketing_query_tickets
        - vulnerabilities_create_asset
        - vulnerabilities_create_findings
        - vulnerabilities_get_labels
        - vulnerabilities_get_scan_activity
        - vulnerabilities_get_scan_status
        - vulnerabilities_query_assets
        - vulnerabilities_query_findings
        - vulnerabilities_query_scans
        - vulnerabilities_update_asset
        - vulnerabilities_update_finding
        - vulnerabilities_upload_scan
    CreateOperationRequest:
      title: CreateOperationRequest
      type: object
      properties:
        operation:
          type: string
          description: Name of the operation that will be run for this operation.
        input:
          $ref: '#/components/schemas/OperationInput'
          description: >-
            Input parameters to the operation that will be run for this
            operation.
      required:
        - operation
        - input
    CreateOperationResponseResult:
      title: CreateOperationResponseResult
      type: object
      properties:
        operation:
          $ref: '#/components/schemas/Operation'
      required:
        - operation
    CreateOperationResponse:
      title: CreateOperationResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/CreateOperationResponseResult'
      required:
        - result
    GetOperationResponse:
      title: GetOperationResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Operation'
      required:
        - result
    WebhookEvent:
      title: WebhookEvent
      type: string
      enum:
        - TicketCreated
        - TicketUpdated
        - TicketDeleted
        - TicketCommentCreated
        - TicketCommentDeleted
    CreateSiemEventsResponse:
      title: CreateSiemEventsResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: >-
            List of events written if available. Most providers do not return
            events, just a success status. Review messages for any failure
            details available.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QuerySiemEventsResponse:
      title: QuerySiemEventsResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of events
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
        - $ref: '#/components/schemas/APIHasStatus'
    QueryInvestigationResponse:
      title: QueryInvestigationResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Investigation'
          description: List of investigations
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    QuerySiemAlertsResponse:
      title: QuerySiemAlertsResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of alerts
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetAlertResponse:
      title: GetAlertResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ocsfv1.3.0detectionfindingDetectionFinding'
          description: The mapped alert
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryInvestigationResponseGeneric:
      title: QueryInvestigationResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: List of investigations
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    PatchInvestigationRequest:
      title: PatchInvestigationRequest
      type: array
      items:
        $ref: '#/components/schemas/PatchOperation'
      description: JSON patch to apply to an investigation.
    Investigation:
      title: Investigation
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the investigation
        custom_fields:
          type: object
          additionalProperties: true
          nullable: true
          description: Custom mapped fields from the investigation
        raw_data:
          type: string
          description: Original response from the SIEM
      required:
        - id
        - raw_data
    Evidence:
      title: Evidence
      type: object
      properties:
        investigation_id:
          type: string
          description: Unique identifier for the investigation associated with the evidence
        raw_data:
          type: string
          description: Original response from the SIEM
      required:
        - investigation_id
        - raw_data
    GetInvestigationResponse:
      title: GetInvestigationResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Investigation'
          description: The investigation object
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetInvestigationResponseGeneric:
      title: GetInvestigationResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: The investigation object
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetEvidenceResponse:
      title: GetEvidenceResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Evidence'
          description: List of evidence associated with an investigation
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetEvidenceResponseGeneric:
      title: GetEvidenceResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: The evidence object
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetAlertResponseGeneric:
      title: GetAlertResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
          description: The mapped alerts, by default in OCSF Detection Finding format.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    LogProvider:
      title: LogProvider
      type: object
      properties:
        source:
          type: string
          nullable: true
          description: >-
            Some backing providers have multiple log source types. When
            available, this metadata provides an indication of the backing
            provider' log provider type.
        name:
          type: string
          description: >-
            Name of the log provider, usable as a filter value for
            metadata.log_provider when querying for events.
      required:
        - name
    QueryLogProvidersResponse:
      title: QueryLogProvidersResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/LogProvider'
          description: >-
            List of available metadata.log_provider values available for
            querying events
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
        - $ref: '#/components/schemas/APIHasStatus'
    CreateSinkEventsResponse:
      title: CreateSinkEventsResponse
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: >-
            List of events written if available. Most providers do not return
            events, just a success status. Review messages for any failure
            details available.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    stixId:
      title: stixId
      type: string
    stixExternalReference:
      title: stixExternalReference
      type: object
      properties:
        source_name:
          type: string
          description: >-
            The source_name property specifies the name of the source that
            provided the external reference.
        description:
          type: string
          nullable: true
          description: >-
            The description property provides a human-readable explanation of
            the external reference.
        url:
          type: string
          nullable: true
          description: The url property specifies the URL of the external reference.
        hash:
          type: string
          nullable: true
          description: >-
            The hash property specifies a hash value that uniquely identifies
            the external reference.
        external_id:
          type: string
          nullable: true
          description: >-
            The external_id property specifies an identifier used by the source
            of the external reference.
      required:
        - source_name
    stixGranularMarking:
      title: stixGranularMarking
      type: object
      properties:
        lang:
          type: string
          nullable: true
          description: >-
            The lang property specifies the language used in the properties of
            the marking_definition object.
        marking_ref:
          $ref: '#/components/schemas/stixMarkingDefinition'
          nullable: true
          description: >-
            The marking_ref property specifies the id property of the
            marking_definition object that applies to this object.
        selectors:
          type: array
          items:
            type: string
          description: >-
            The selectors property is an array of strings that represent the
            selectors that are used to apply the marking_definition object to
            this object.
      required:
        - selectors
    stixKillChainPhase:
      title: stixKillChainPhase
      type: object
      properties:
        kill_chain_name:
          type: string
          description: >-
            The kill_chain_name property specifies the name of the kill chain to
            which the phase belongs.
        phase_name:
          type: string
          description: >-
            The phase_name property specifies the name of the phase within the
            kill chain.
      required:
        - kill_chain_name
        - phase_name
    stixCommonProperties:
      title: stixCommonProperties
      type: object
      properties:
        spec_version:
          type: string
          const: '2.1'
        id:
          $ref: '#/components/schemas/stixId'
          description: The id property uniquely identifies this object.
        created_by_ref:
          $ref: '#/components/schemas/stixIdentity'
          nullable: true
          description: >-
            The created_by_ref property specifies the id property of the
            identity object that describes the entity that created this object.
        created:
          type: string
          format: date-time
          description: >-
            The created property represents the time at which the object was
            originally created.
        modified:
          type: string
          format: date-time
          description: >-
            The modified property is only used by STIX Objects that support
            versioning and represents the time that this particular version of
            the object was last modified.
        revoked:
          type: boolean
          nullable: true
          description: >-
            The revoked property indicates whether this object has been revoked.
            If the revoked property is present and set to true, then the object
            has been revoked.
        labels:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            The labels property is an array of strings that are used to
            categorize this object.
        confidence:
          type: integer
          nullable: true
          description: >-
            The confidence property is an integer from 0 to 100 that represents
            the confidence that this object is accurate and valid.
        lang:
          type: string
          nullable: true
          description: >-
            The lang property specifies the language used in the properties of
            the object.
        external_references:
          type: array
          items:
            $ref: '#/components/schemas/stixExternalReference'
          nullable: true
          description: >-
            The external_references property is an array of external references
            that are relevant to this object.
        object_marking_refs:
          type: array
          items:
            $ref: '#/components/schemas/stixMarkingDefinition'
          nullable: true
          description: >-
            The object_marking_refs property is an array of ids of
            marking_definition objects that apply to this object.
        granular_markings:
          type: array
          items:
            $ref: '#/components/schemas/stixGranularMarking'
          nullable: true
          description: >-
            The granular_markings property is an array of granular markings that
            are applied to this object.
        extensions:
          type: object
          additionalProperties: true
          nullable: true
          description: >-
            The extensions property is an object that contains custom properties
            or objects that extend the object.
      required:
        - spec_version
        - id
        - created
        - modified
    stixMarkingDefinition:
      title: stixMarkingDefinition
      type: object
      properties:
        type:
          type: string
          description: >-
            The type property identifies the type of object. The value of this
            property MUST be marking_definition.
        name:
          type: string
          nullable: true
      required:
        - type
    stixIdentity:
      title: stixIdentity
      type: object
      properties:
        type:
          type: string
          description: The value of this property MUST be identity.
        name:
          type: string
          description: >-
            The name of this Identity. When referring to a specific entity
            (e.g., an individual or organization), this property SHOULD contain
            the canonical name of the specific entity.
        description:
          type: string
          nullable: true
        roles:
          type: string
          nullable: true
          description: >-
            The list of roles that this Identity performs. No open vocabulary is
            yet defined for this property.
        identity_class:
          $ref: '#/components/schemas/stixidentity_class_ov'
          nullable: true
      required:
        - type
        - name
      allOf:
        - $ref: '#/components/schemas/stixCommonProperties'
    stixIndicator:
      title: stixIndicator
      type: object
      properties:
        type:
          type: string
          const: indicator
        name:
          type: string
          nullable: true
          description: A name used to identify the Indicator.
        description:
          type: string
          nullable: true
          description: >-
            A description that provides more details and context about the
            Indicator, potentially including its purpose and its key
            characteristics.
        indicator_types:
          type: array
          items:
            $ref: '#/components/schemas/stixindicator_type_ov'
          nullable: true
          description: A set of categorizations for this indicator.
        pattern:
          type: string
          nullable: true
          description: >-
            The detection pattern for this Indicator MAY be expressed as a STIX
            Pattern as specified in section 9 or another appropriate language
            such as SNORT, YARA, etc.
        pattern_type:
          $ref: '#/components/schemas/stixpattern_type_ov'
          nullable: true
          description: The type of pattern expression used in the pattern property.
        pattern_version:
          type: string
          nullable: true
          description: The version of the pattern expression used in the pattern property.
        valid_from:
          type: string
          format: date-time
          description: >-
            The time from which this Indicator is considered a valid indicator
            of the behaviors it is related or represents.
        valid_until:
          type: string
          format: date-time
          nullable: true
          description: The time at which this Indicator is no longer considered valid.
        kill_chain_phases:
          type: array
          items:
            $ref: '#/components/schemas/stixKillChainPhase'
          nullable: true
          description: The kill chain phase to which this Indicator corresponds.
        raw_data:
          type: string
          nullable: true
          description: The data as received from the source.
      required:
        - type
        - valid_from
      allOf:
        - $ref: '#/components/schemas/stixCommonProperties'
    stixindicator_type_ov:
      title: stixindicator_type_ov
      type: string
      enum:
        - anomalous_activity
        - anonymization
        - benign
        - compromised
        - malicious_activity
        - attribution
        - unknown
    stixpattern_type_ov:
      title: stixpattern_type_ov
      type: string
      enum:
        - stix
        - pcre
        - sigma
        - snort
        - suricata
        - yara
      description: covers common pattern languages
    stixidentity_class_ov:
      title: stixidentity_class_ov
      type: string
      enum:
        - individual
        - group
        - system
        - organization
        - class
        - unknown
    ListStorageResponse:
      title: ListStorageResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/StoragePath'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    StoragePath:
      title: StoragePath
      type: object
      properties:
        path:
          type: string
      required:
        - path
    AttachmentId:
      title: AttachmentId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for an attachment
    IssueTypeId:
      title: IssueTypeId
      type: string
      description: Unique identifier for an issue type
    ProjectId:
      title: ProjectId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for a project
    TicketId:
      title: TicketId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for this ticket
    CommentId:
      title: CommentId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for a comment
    Priority:
      title: Priority
      type: string
      enum:
        - URGENT
        - CRITICAL
        - HIGH
        - MEDIUM
        - MODERATE
        - LOW
        - PLANNING
    Status:
      title: Status
      type: string
    Ticket:
      title: Ticket
      type: object
      description: Ticketing ticket
      properties:
        id:
          $ref: '#/components/schemas/Id'
        summary:
          type: string
          description: Ticket summary.
        creator:
          type: string
          nullable: true
          description: User who created this ticket.
        assignee:
          type: string
          nullable: true
          description: Who ticket is assigned to.
        contact:
          type: string
          nullable: true
          description: Ticket contact information.
        description:
          type: string
          nullable: true
          description: Ticket description.
        priority:
          $ref: '#/components/schemas/Priority'
          nullable: true
          description: The priority of the Ticket
        due_date:
          type: string
          format: date-time
          nullable: true
          description: The ticket's due date.
        completion_date:
          type: string
          format: date-time
          nullable: true
          description: The ticket's complete date.
        status:
          $ref: '#/components/schemas/Status'
          nullable: true
          description: The current status of the ticket.
        project:
          $ref: '#/components/schemas/Id'
          nullable: true
          description: The ticket project.
        issue_type:
          $ref: '#/components/schemas/IssueTypeId'
          nullable: true
          description: The ticket's type.
        tags:
          type: array
          items:
            type: string
          nullable: true
          description: Associate tags with Ticket
        attachments:
          type: array
          items:
            $ref: '#/components/schemas/AttachmentMetadata'
          nullable: true
          description: Metadata of attachments associated with the ticket
        custom_fields:
          type: object
          additionalProperties: true
          nullable: true
          description: Custom fields for this ticket, keys are the custom field names.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the ticket schema. The names
            and values of those attributes are specific to the provider.
      required:
        - id
        - summary
      allOf:
        - $ref: '#/components/schemas/Base'
    Project:
      title: Project
      type: object
      description: Project in a ticketing system
      properties:
        id:
          type: string
          description: >-
            Unique identifier for this project. Use this id in the `project`
            field of a `Ticket`.
        name:
          type: string
          description: Name of the project
        custom_fields:
          type: object
          additionalProperties: true
          nullable: true
          description: Custom mapped fields for this project.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the project schema. The names
            and values of those attributes are specific to the provider.
      required:
        - id
        - name
    Attachment:
      title: Attachment
      type: object
      properties:
        file_name:
          type: string
          description: The name of the file.
        file_type:
          type: string
          description: The type of the file.
        content:
          type: string
          format: byte
          description: File contents
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the attachment schema. The
            names and values of those attributes are specific to the provider.
      required:
        - file_name
        - file_type
        - content
    AttachmentMetadata:
      title: AttachmentMetadata
      type: object
      description: Attachment in a ticketing system
      properties:
        id:
          $ref: '#/components/schemas/Id'
          description: Unique identifier for this attachment.
        ticket_id:
          $ref: '#/components/schemas/Id'
          description: The ticket this attachment is associated with.
        file_name:
          type: string
          description: The name of the file.
        file_type:
          type: string
          description: The type of the file.
        file_size:
          type: integer
          nullable: true
          description: The size of the file in bytes.
        created_date:
          type: string
          format: date-time
          description: The date the attachment was created.
        creator:
          type: string
          description: The user who created the attachment.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the attachment metadata
            schema. The names and values of those attributes are specific to the
            provider.
      required:
        - id
        - ticket_id
        - file_name
        - file_type
        - created_date
        - creator
    RemoteField:
      title: RemoteField
      type: object
      properties:
        field_id:
          type: string
          description: Remote ID of the field.
        schema:
          $ref: '#/components/schemas/RemoteFieldSchema'
          nullable: true
          description: Schema of the field.
        field_scope:
          $ref: '#/components/schemas/RemoteFieldScope'
          description: Scope of remote field - standard or some kind of customization?
        provider_field_name:
          type: string
          description: Name of field in the remote ticketing provider.
        provider_field_path:
          type: string
          nullable: true
          description: >-
            Path to the field in the remote ticketing provider. Uses dot
            notation for nested fields.
        project_id:
          type: string
          nullable: true
          description: Project id to which this field is scoped to
      required:
        - field_id
        - field_scope
        - provider_field_name
    RemoteFieldSchema:
      title: RemoteFieldSchema
      type: object
      properties:
        field_type_id:
          $ref: '#/components/schemas/RemoteFieldTypeId'
        field_Type:
          type: string
          nullable: true
        enum_values:
          type: array
          items:
            type: string
          nullable: true
          description: Display names for possible values the enum can take on.
        enum_option_values:
          type: array
          items:
            $ref: '#/components/schemas/OptionValue'
          nullable: true
          description: >-
            Possible values the enum can take on. For providers which don't
            distinguish between ID and display name, the ID and display name
            should be set to the same value.
      required:
        - field_type_id
    RemoteFieldTypeId:
      title: RemoteFieldTypeId
      type: string
      enum:
        - string
        - number
        - enum
        - other
    RemoteFieldScope:
      title: RemoteFieldScope
      type: string
      enum:
        - standard
        - integration_custom
        - project_custom
        - ticket_custom
        - unknown
    Comment:
      title: Comment
      type: object
      description: Comment on a ticket.
      properties:
        id:
          $ref: '#/components/schemas/Id'
        ticket_id:
          $ref: '#/components/schemas/Id'
        creator:
          type: string
          description: The user who created the comment.
        content:
          type: string
          description: The content of the comment formatted as markdown.
        created_at:
          type: string
          format: date-time
          description: The date the comment was created.
        updated_at:
          type: string
          format: date-time
          nullable: true
          description: The date the comment was last updated.
        custom_fields:
          type: object
          additionalProperties: true
          nullable: true
          description: Custom mapped fields for this project.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the comment schema. The names
            and values of those attributes are specific to the provider.
      required:
        - id
        - ticket_id
        - creator
        - content
        - created_at
    Agent:
      title: Agent
      type: object
      description: An agent is a human that can be notified when certain conditions are met
      properties:
        uid:
          $ref: '#/components/schemas/Id'
        full_name:
          type: string
        email_addr:
          type: string
          nullable: true
        phone_number:
          type: string
          nullable: true
        time_zone:
          type: string
          nullable: true
        job_title:
          type: string
          nullable: true
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the comment schema. The names
            and values of those attributes are specific to the provider.
      required:
        - uid
        - full_name
    AgentSummary:
      title: AgentSummary
      type: object
      description: >-
        The agent summary object gives a summary of an agent in an escalation
        policy. An agent is a human that can be notified when certain conditions
        are met
      properties:
        id:
          $ref: '#/components/schemas/Id'
          description: Unique identifier for the agent.
        name:
          type: string
          description: Name of the agent.
        additional_properties:
          type: boolean
          description: >-
            Indicates if the agent has additional properties that can be
            retrieved.
      required:
        - id
        - name
        - additional_properties
    GroupSummary:
      title: GroupSummary
      type: object
      description: >-
        The group summary object gives a summary of a group in an escalation
        policy. A group is a collection of agents that can be notified when
        certain conditions are met
      properties:
        id:
          $ref: '#/components/schemas/Id'
          description: Unique identifier for the group.
        name:
          type: string
          nullable: true
          description: Name of the group.
        additional_properties:
          type: boolean
          description: >-
            Indicates if the group has additional properties that can be
            retrieved.
      required:
        - id
        - additional_properties
    ScheduleSummary:
      title: ScheduleSummary
      type: object
      description: >-
        The schedule summary object gives a summary of a schedule in an
        escalation policy. A schedule is a collection of agents that are
        notified at specific times
      properties:
        id:
          $ref: '#/components/schemas/Id'
          description: Unique identifier for the schedule.
        name:
          type: string
          nullable: true
          description: Name of the schedule.
        additional_properties:
          type: boolean
          description: >-
            Indicates if the schedule has additional properties that can be
            retrieved.
      required:
        - id
        - additional_properties
    Actor:
      title: Actor
      oneOf:
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - agent
            - $ref: '#/components/schemas/Agent'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - agent_summary
            - $ref: '#/components/schemas/AgentSummary'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - group_summary
            - $ref: '#/components/schemas/GroupSummary'
          required:
            - type
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - schedule_summary
            - $ref: '#/components/schemas/ScheduleSummary'
          required:
            - type
      description: >-
        The actor object either relates gives a summary of an actor in an
        escalation policy or gives full details of an actor. This depends on the
        capabilities of the ticketing provider. An actor is someone or something
        that will be notified when certain conditions are met. It can either be
        an agent, a group, or a schedule.
    EscalationPolicy:
      title: EscalationPolicy
      type: object
      description: >-
        The escalation policy object describes an escalation policy for a
        ticket. It contains an id for the escalation policy, an optional name,
        an optional description, and a list of rules.
      properties:
        id:
          $ref: '#/components/schemas/Id'
        name:
          type: string
          nullable: true
        description:
          type: string
          nullable: true
        rules:
          type: array
          items:
            $ref: '#/components/schemas/EscalationPolicyRule'
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the comment schema. The names
            and values of those attributes are specific to the provider.
      required:
        - id
        - rules
    EscalationPolicyRule:
      title: EscalationPolicyRule
      type: object
      description: >-
        The escalation policy rule object describes a rule for an escalation
        policy. It contains an optional id for the rule, a delay in seconds
        before the next actor is notified, and a list of actors.
      properties:
        id:
          $ref: '#/components/schemas/Id'
          nullable: true
        delay_seconds:
          type: integer
        actors:
          type: array
          items:
            $ref: '#/components/schemas/Actor'
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the comment schema. The names
            and values of those attributes are specific to the provider.
      required:
        - delay_seconds
        - actors
    CreateTicketRequest:
      title: CreateTicketRequest
      type: object
      properties:
        summary:
          type: string
          nullable: true
          description: Ticket summary.
        creator:
          type: string
          nullable: true
          description: User who created this ticket.
        assignee:
          type: string
          nullable: true
          description: Who ticket is assigned to.
        contact:
          type: string
          nullable: true
          description: Ticket contact information.
        description:
          type: string
          nullable: true
          description: Ticket description.
        priority:
          $ref: '#/components/schemas/Priority'
          nullable: true
          description: The priority of the Ticket
        due_date:
          type: string
          format: date-time
          nullable: true
          description: The ticket's due date.
        completion_date:
          type: string
          format: date-time
          nullable: true
          description: The ticket's complete date.
        status:
          $ref: '#/components/schemas/Status'
          nullable: true
          description: The current status of the ticket.
        project:
          type: string
          nullable: true
          description: The ticket project.
        issue_type:
          type: string
          nullable: true
          description: The ticket's type.
        tags:
          type: array
          items:
            type: string
          nullable: true
          description: Associate tags with Ticket
        custom_fields:
          type: object
          additionalProperties: true
          nullable: true
          description: Set custom fields for this ticket, keys are the custom field names.
      allOf:
        - $ref: '#/components/schemas/BaseResourceRequest'
    CreateAttachmentRequest:
      title: CreateAttachmentRequest
      type: object
      properties:
        file_name:
          type: string
          description: The name of the file.
        content:
          type: string
          format: byte
          description: File contents
      required:
        - file_name
        - content
    QueryTicketsResponse:
      title: QueryTicketsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Ticket'
          description: list of results
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateCommentRequest:
      title: CreateCommentRequest
      type: object
      properties:
        creator:
          type: string
          nullable: true
          description: >-
            Email address of user who created this ticket. Required by
            PagerDuty. Not supported by Jira, ServiceNow, or Torq.
        content:
          type: string
          description: The content of the comment.
      required:
        - content
    CreateTicketResponse:
      title: CreateTicketResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Ticket'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetTicketResponse:
      title: GetTicketResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Ticket'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListProjectsResponse:
      title: ListProjectsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Project'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    PatchTicketResponse:
      title: PatchTicketResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Ticket'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateAttachmentResponse:
      title: CreateAttachmentResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/AttachmentMetadata'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListAttachmentsMetadataResponse:
      title: ListAttachmentsMetadataResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/AttachmentMetadata'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    DownloadAttachmentResponse:
      title: DownloadAttachmentResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Attachment'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListRemoteFieldsResponse:
      title: ListRemoteFieldsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/RemoteField'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListCommentsResponse:
      title: ListCommentsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Comment'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateCommentResponse:
      title: CreateCommentResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Comment'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    PatchNoteResponse:
      title: PatchNoteResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Note'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryEscalationPoliciesResponse:
      title: QueryEscalationPoliciesResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/EscalationPolicy'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    ListOnCallResponse:
      title: ListOnCallResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Agent'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    NoteId:
      title: NoteId
      $ref: '#/components/schemas/Id'
      description: Unique identifier for a note
    Note:
      title: Note
      type: object
      description: Note on a ticket
      properties:
        id:
          $ref: '#/components/schemas/Id'
        ticket_id:
          $ref: '#/components/schemas/Id'
        content:
          type: string
          description: The content of the note formatted as markdown.
        creator:
          type: string
          description: The user who created the note.
        title:
          type: string
          description: The title of the note.
        created_at:
          type: string
          format: date-time
          description: The date the comment was created.
        updated_at:
          type: string
          format: date-time
          nullable: true
          description: The date the comment was last updated.
        custom_fields:
          type: object
          additionalProperties: true
          nullable: true
          description: Custom mapped fields for this note.
        unmapped:
          $ref: '#/components/schemas/Object'
          nullable: true
          description: >-
            The attributes that are not mapped to the comment schema. The names
            and values of those attributes are specific to the provider.
      required:
        - id
        - ticket_id
        - content
        - creator
        - title
        - created_at
    CreateNoteRequest:
      title: CreateNoteRequest
      type: object
      properties:
        content:
          type: string
          description: The content of the note formatted as markdown.
        title:
          type: string
          description: The title of the note.
      required:
        - content
        - title
    CreateNoteResponse:
      title: CreateNoteResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/Note'
      required:
        - result
    ListNotesResponse:
      title: ListNotesResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/Note'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryTicketsResponseGeneric:
      title: QueryTicketsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
          description: list of results
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateTicketResponseGeneric:
      title: CreateTicketResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetTicketResponseGeneric:
      title: GetTicketResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListProjectsResponseGeneric:
      title: ListProjectsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    PatchTicketResponseGeneric:
      title: PatchTicketResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListCommentsResponseGeneric:
      title: ListCommentsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    CreateCommentResponseGeneric:
      title: CreateCommentResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    PatchNoteResponseGeneric:
      title: PatchNoteResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ListNotesResponseGeneric:
      title: ListNotesResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryEscalationPoliciesResponseGeneric:
      title: QueryEscalationPoliciesResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    ListOnCallResponseGeneric:
      title: ListOnCallResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateAssetStatus:
      title: CreateAssetStatus
      type: string
      enum:
        - Unknown
        - Pending
        - Complete
    UploadScanStatus:
      title: UploadScanStatus
      type: string
      enum:
        - Unknown
        - Pending
        - Complete
        - Error
    SecurityFinding:
      title: SecurityFinding
      $ref: '#/components/schemas/ocsfv1.3.0securityfindingSecurityFinding'
      description: >-
        Result of a vulnerability scan. Represented by OCSF Security Finding
        class (class_uid 2001).
    Asset:
      title: Asset
      $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
      description: >-
        Asset in a vulnerability scanning system. Represented by OCSF Device
        Inventory Info class (class_uid 5001).
    QueryFindingsResponse:
      title: QueryFindingsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingSecurityFinding'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
        - $ref: '#/components/schemas/APIHasStatus'
    CreateFindingsRequest:
      title: CreateFindingsRequest
      type: object
      properties:
        findings:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0securityfindingSecurityFinding'
      required:
        - findings
    CreateFindingsResponse:
      title: CreateFindingsResponse
      type: object
      properties:
        status:
          $ref: '#/components/schemas/QueryStatus'
          description: >-
            Specifies the status of the create/import findings job, which can be
            COMPLETE or PENDING.
        errors:
          type: array
          items:
            $ref: '#/components/schemas/CreateFindingsError'
          nullable: true
          description: >-
            Provides additional details about any errors encountered during the
            create/import operation.
      required:
        - status
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateFindingsError:
      title: CreateFindingsError
      type: object
      properties:
        message:
          type: string
          description: >-
            A descriptive error message providing more information about the
            issue.
      required:
        - message
    UpdateFindingRequest:
      title: UpdateFindingRequest
      type: object
      properties:
        severity_id:
          $ref: '#/components/schemas/ocsfv1.3.0securityfindingSeverityId'
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverityFilterValue'
          nullable: true
          description: severity of the finding
        state:
          $ref: '#/components/schemas/VulnerabilityStateFilterValue'
          nullable: true
          description: state of the finding
        unmapped:
          $ref: '#/components/schemas/ProviderSpecificFindingState'
          nullable: true
      required:
        - severity_id
    VulnerabilityStateFilterValue:
      title: VulnerabilityStateFilterValue
      type: string
      enum:
        - Unknown
        - New
        - InProgress
        - Resolved
        - Other
      description: The normalized state identifier of a security finding
    ProviderSpecificFindingState:
      title: ProviderSpecificFindingState
      oneOf:
        - type: object
          allOf:
            - type: object
              properties:
                type:
                  type: string
                  enum:
                    - nucleus
            - $ref: '#/components/schemas/NucleusFindingState'
          required:
            - type
    NucleusFindingState:
      title: NucleusFindingState
      type: object
      properties:
        due_date:
          type: string
          format: date-time
          nullable: true
          description: Due date for the finding.
        comment:
          type: string
          nullable: true
          description: Comment to add to the finding.
    QueryAssetsResponse:
      title: QueryAssetsResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
        - $ref: '#/components/schemas/APIHasStatus'
    CreateAssetRequest:
      title: CreateAssetRequest
      type: object
      properties:
        asset:
          $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
          description: Asset to create in the vulnerability scanning system.
        source_name:
          type: string
          description: Name of the source that created the asset.
      required:
        - asset
        - source_name
    CreateAssetResponse:
      title: CreateAssetResponse
      type: object
      properties:
        device:
          $ref: '#/components/schemas/CreateAssetDevice'
          description: Created device.
      required:
        - device
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    CreateAssetDevice:
      title: CreateAssetDevice
      type: object
      properties:
        uid:
          type: string
          nullable: true
          description: ID of the device.
        status:
          $ref: '#/components/schemas/CreateAssetStatus'
          description: Status of the creation of the asset in the providers system.
      required:
        - status
    VulnerabilitySeverityFilterValue:
      title: VulnerabilitySeverityFilterValue
      type: string
      enum:
        - critical
        - high
        - medium
        - low
        - info
      description: >-
        Values supported by using severity as a filter. Supports `[eq]` and
        `[in]` operators. For example, `severity[eq]critical` or
        `severity[in]critical, high`.
    QueryScansResponse:
      title: QueryScansResponse
      type: object
      properties:
        result:
          type: array
          items:
            $ref: '#/components/schemas/ScanConfiguration'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    UploadScanRequest:
      title: UploadScanRequest
      type: object
      properties:
        assets:
          type: array
          items:
            $ref: '#/components/schemas/ocsfv1.3.0inventoryinfoInventoryInfo'
          description: >-
            Assets and optional findings to upload in the vulnerability scanning
            system.
        source_name:
          type: string
          nullable: true
          description: >-
            Name of the source for this scan, such as a tool or process. Does
            not have to be unique, defaults to `Integration import`.
      required:
        - assets
    UploadScanResponse:
      title: UploadScanResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ScanStatus'
        errors:
          $ref: '#/components/schemas/Problem'
          nullable: true
          description: >-
            Provides additional details about any errors encountered during the
            upload scan operation.
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetScanStatusResponse:
      title: GetScanStatusResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ScanStatus'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ScanStatus:
      title: ScanStatus
      type: object
      properties:
        scan_id:
          type: string
          description: ID of the scan.
        status:
          $ref: '#/components/schemas/UploadScanStatus'
          description: >-
            Specifies the status of the scan, which can be Complete, Pending, or
            Error.
        message:
          type: string
          nullable: true
          description: Provider specific status message for this scan.
      required:
        - scan_id
        - status
    ScanConfiguration:
      title: ScanConfiguration
      type: object
      description: Configuration options of a scan.
      properties:
        uid:
          type: string
          description: ID of the scan.
        name:
          type: string
          description: Name of the scan.
        creation_time:
          type: integer
          nullable: true
          description: Time when the scan was created.
        last_modified_time:
          type: integer
          nullable: true
          description: Time when the scan was last modified.
        owner:
          $ref: '#/components/schemas/User'
          nullable: true
          description: User that owns the scan.
        schedule:
          $ref: '#/components/schemas/ScanSchedule'
          nullable: true
          description: Schedule of the scan if it is a recurring scan.
      required:
        - uid
        - name
    User:
      title: User
      type: object
      properties:
        uid:
          type: string
          description: ID of the user.
      required:
        - uid
    GetScanActivityResponse:
      title: GetScanActivityResponse
      type: object
      properties:
        result:
          $ref: '#/components/schemas/ocsfv1.3.0scanactivityScanActivity'
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    ScanSchedule:
      title: ScanSchedule
      type: object
      properties:
        time:
          type: string
          description: >-
            Time of the day when the scan are repeated. For scans that are
            executed once, this is the time when the scan was started. This is
            formatted as `HH:MM:SS`.
        frequency:
          $ref: '#/components/schemas/ScanFrequencyOption'
          description: >-
            Periodicity of the scan; for example, weekly, means that the scan
            will be repeated every `repeat_interval` weeks.
        repeat_interval:
          type: integer
          description: >-
            Number of days, weeks, months, or years between scans. For example,
            `1` means that the scan will be repeated once every `frequency`
            period.
        days:
          type: array
          items:
            type: string
          nullable: true
          description: >-
            Days of the week when the scan will be repeated. For example,
            `["monday", "friday"]` means that the scan will be repeated on
            Monday and Friday on the schedule defined by `frequency` and
            `repeat_interval`.
      required:
        - time
        - frequency
        - repeat_interval
    ScanFrequencyOption:
      title: ScanFrequencyOption
      type: string
      enum:
        - once
        - daily
        - weekly
        - monthly
        - yearly
        - unknown
    QueryFindingsResponseGeneric:
      title: QueryFindingsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
        - $ref: '#/components/schemas/APIHasStatus'
    QueryAssetsResponseGeneric:
      title: QueryAssetsResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
        - $ref: '#/components/schemas/APIHasStatus'
    CreateAssetResponseGeneric:
      title: CreateAssetResponseGeneric
      type: object
      properties:
        device:
          type: object
          additionalProperties: true
          description: Created device.
      required:
        - device
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    QueryScansResponseGeneric:
      title: QueryScansResponseGeneric
      type: object
      properties:
        result:
          type: array
          items:
            type: object
            additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIQueryResponse'
    GetScanActivityResponseGeneric:
      title: GetScanActivityResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    UploadScanResponseGeneric:
      title: UploadScanResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
    GetScanStatusResponseGeneric:
      title: GetScanStatusResponseGeneric
      type: object
      properties:
        result:
          type: object
          additionalProperties: true
      required:
        - result
      allOf:
        - $ref: '#/components/schemas/APIResponse'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
servers:
  - url: https://api.synqly.com
    description: Synqly
x-readme:
  explorer-enabled: false
  samples-languages:
    - shell
    - go
tags:
  - name: Appsec
    x-displayName: Application Security (Pre-Release)
    description: |
      {% admonition type="info" name="Pre-Release" %}
      This feature is available for testing but may be unstable. Breaking
      changes are unlikely but may still be necessary.

      Please contact us before using this feature.
      {% /admonition %}
    x-synqly-availability:
      status: pre-release
  - name: Assets
    x-displayName: Assets
  - name: Cloudsecurity
    x-displayName: Cloud Security (In Development)
    description: |
      {% admonition type="warning" name="In Development" %}
      This feature is actively being developed. Breaking changes should be
      expected.

      Please contact us before using this feature.
      {% /admonition %}
    x-synqly-availability:
      status: in-development
  - name: Edr
    x-displayName: Endpoint Detection & Response (EDR)
    description: ''
    x-synqly-availability:
      status: generally-available
      operations:
        edr_query_edr_events: in-development
  - name: Hooks
    x-displayName: Hooks
  - name: Identity
    x-displayName: Identity
    description: ''
    x-synqly-availability:
      status: generally-available
      operations:
        identity_get_user_picture: pre-release
  - name: Incidentresponse
    x-displayName: Incident Response (In Development)
    description: |
      {% admonition type="warning" name="In Development" %}
      This feature is actively being developed. Breaking changes should be
      expected.

      Please contact us before using this feature.
      {% /admonition %}
    x-synqly-availability:
      status: in-development
  - name: IntegrationWebhooks
    x-displayName: Integration Webhooks
  - name: Notifications
    x-displayName: Notifications
  - name: Operations
    x-displayName: Operations (In Development)
    description: |
      {% admonition type="warning" name="In Development" %}
      This feature is actively being developed. Breaking changes should be
      expected.

      Please contact us before using this feature.
      {% /admonition %}
    x-synqly-availability:
      status: in-development
  - name: Siem
    x-displayName: Security Information & Event Management (SIEM)
    description: ''
    x-synqly-availability:
      status: generally-available
  - name: Sink
    x-displayName: Sink
  - name: Storage
    x-displayName: Storage
  - name: Ticketing
    x-displayName: Ticketing
    description: ''
    x-synqly-availability:
      status: generally-available
      operations:
        ticketing_query_escalation_policies: generally-available
        ticketing_list_on_call: generally-available
  - name: Vulnerabilities
    x-displayName: Vulnerabilities
    description: ''
    x-synqly-availability:
      status: generally-available
      operations:
        vulnerabilities_upload_scan: in-development
        vulnerabilities_get_scan_status: in-development
